CVE-2026-126206
Loofah allowed_uri? treats data:text/html as safe text/plain
- Medium 5.3
Description
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.allowed_uri? treats a data URI mediatype containing the HTML5 named solidus reference / as malformed and falls back to the allowed text/plain, while a browser decodes the reference and interprets the same value as text/html. An application that validates a user-controlled URL with this helper and renders the approved value in href or another browser-interpreted URI attribute can allow cross-site scripting. Rails::HTML::Sanitizer.allowed_uri? re-exports the affected helper. Loofah's default sanitize() path is not affected because Nokogiri decodes the entity before URI validation. This issue is fixed in version 2.25.3.
Key facts
- Published
- 12 Nov 2026
- Last changed
- 13 Nov 2026
- Assigned by
- GitHub_M
- EPSS
- 0.417% likely to be exploited in the next 30 days, higher than 36.499% of CVEs (scores for 15 Nov 2026)
- SSVC (CISA)
- Exploitation: none; Automatable: yes; Technical impact: partial
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 5.3CVSS 4.0, Mediumfrom the CNA (GitHub_M)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.
No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| flavorjones | loofah |
|
Timeline
- 12 Nov 2026 Published
Weakness
Practice this bug class
HackZoneLabs has a hands-on lab on XSS (stored, reflected, DOM) (CWE-79).