CVE-2026-73492

Received Received - Intake

XSS via URI Scheme in Loofah HTML Sanitizer

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as &#58, &#9, &#10, or &#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-73492

Affected Vendors & Products

Vendor	Product	Version / Range
loofah	loofah	to 2.25.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Loofah versions 2.25.0 to 2.25.2 have a flaw in Loofah::HTML5::Scrub.allowed_uri? which fails to block javascript: or vbscript: URIs when the scheme is split by semicolon-less numeric character references like &#58, &#9, &#10, or &#13. This allows malicious URIs to bypass sanitization checks.

Detection Guidance

This vulnerability affects Loofah versions 2.25.0 to 2.25.2. To detect it, check the installed version of Loofah in your Ruby environment using the command: gem list loofah. If the version is between 2.25.0 and 2.25.2, the system is vulnerable.

Impact Analysis

If you use Loofah to sanitize HTML-encoded strings passed directly to allowed_uri?, an attacker could craft a URI that bypasses security checks. When processed by a browser, the encoded characters decode into a malicious script execution URI, potentially leading to code execution or phishing attacks.

Compliance Impact

This vulnerability could lead to unauthorized code execution or data exfiltration, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using affected Loofah versions may fail compliance audits due to inadequate input sanitization.

Mitigation Strategies

Upgrade Loofah to version 2.25.2 or later immediately. Use the command: gem install loofah -v '>=2.25.2'. If you cannot upgrade, avoid passing HTML-encoded strings directly to Loofah::HTML5::Scrub.allowed_uri?.

Hi! I’m here to help you understand CVE-2026-73492. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70