CVE-2026-73491

Received Received - Intake

Cross-Site Scripting via javascript: URI in Loofah

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character references &Tab; or &NewLine;. CGI.unescapeHTML leaves those references intact, so allowed_uri? reports the URL safe even though a browser decodes and strips the tab or line feed and executes the resulting javascript: URL. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-73491

Affected Vendors & Products

Vendor	Product	Version / Range
loofah	loofah	From 2.25.0 (exc) to 2.25.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

Executive Summary

Loofah is a library for processing HTML/XML documents. Between versions 2.25.0 and 2.25.2, a flaw in Loofah::HTML5::Scrub.allowed_uri? allowed javascript: URIs to bypass sanitization if the scheme was split or prefixed with HTML5 whitespace characters like &Tab; or &NewLine;. This happened because CGI.unescapeHTML did not decode these references, making the URI appear safe even though browsers would execute the javascript: URL after decoding.

Detection Guidance

This vulnerability affects Loofah versions 2.25.0 to 2.25.2. To detect it, check the installed Loofah version using gem list loofah. If the version is between 2.25.0 and 2.25.2, the system is vulnerable.

Impact Analysis

If you use Loofah in versions 2.25.0 to 2.25.2 and pass HTML-encoded strings directly to allowed_uri?, malicious javascript: URIs could bypass sanitization. This could lead to stored or reflected XSS attacks if user input is not properly sanitized before rendering in a browser.

Mitigation Strategies

Upgrade Loofah to version 2.25.2 or later immediately. Use the command gem install loofah -v '>=2.25.2' to update. If using Bundler, update the Gemfile to specify loofah '>=2.25.2' and run bundle update loofah.

Hi! I’m here to help you understand CVE-2026-73491. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70