CVE-2026-73490

Received Received - Intake

Stored XSS in Loofah HTML Sanitizer via SVG

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept the plain href attribute. A crafted sanitized SVG can therefore reference an arbitrary same-origin external document; use may render external SVG content containing scripts or other dangerous content, and feImage may load external images for tracking. Applications that sanitize user-supplied SVG with Loofah's default allowlist are affected. This issue is fixed in version 2.25.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-73490

Affected Vendors & Products

Vendor	Product	Version / Range
loofah	loofah	to 2.25.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Loofah is a library for processing HTML/XML documents. This vulnerability affects versions before 2.25.2. The HTML5 sanitizer only restricts local references in the xlink:href attribute for SVG elements but not the plain href attribute. This allows a crafted SVG to reference external documents, potentially loading malicious content like scripts or tracking images.

Impact Analysis

If you use Loofah to sanitize user-supplied SVG content, attackers could inject malicious SVG that references external resources. This may lead to execution of scripts, data exfiltration, or tracking of users. The impact depends on how the sanitized content is used in your application.

Compliance Impact

This vulnerability could lead to unauthorized data access or script execution, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected Loofah versions may face compliance risks if user data is compromised through this flaw.

Mitigation Strategies

Update Loofah to version 2.25.2 or later to address the vulnerability. If updating is not immediately possible, consider disabling SVG sanitization for user-supplied content or implementing additional input validation.

Hi! I’m here to help you understand CVE-2026-73490. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70