Skip to main content

Loofah CVE-2026-73491

| EUVDEUVD-2026-57628 LOW
Incomplete List of Disallowed Inputs (CWE-184)
2026-08-12 GitHub_M
Information Disclosure Loofah
2.3
CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY
2.3 LOW
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.9 MEDIUM

AC:H because exploitation requires non-default direct `allowed_uri?` usage with HTML-encoded input; PR:L for attacker URL submission access; S:C and C:L/I:L for downstream XSS browser impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 12, 2026 - 22:03 EUVD
Source Code Evidence Fetched
Aug 12, 2026 - 21:45 vuln.today
Analysis Generated
Aug 12, 2026 - 21:45 vuln.today

DescriptionCVE.org

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character references 	 or 
. CGI.unescapeHTML leaves those references intact, so allowed_uri? reports the URL safe even though a browser decodes and strips the tab or line feed and executes the resulting javascript: URL. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

AnalysisAI

Cross-site scripting bypass in Loofah 2.25.0-2.25.1 allows attackers to smuggle javascript: URIs past the allowed_uri? helper by inserting HTML5 named whitespace character references (	 or 
) into the scheme. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Submit URL with 	 in scheme
Delivery
Pass HTML-encoded string to allowed_uri?
Exploit
Method approves javascript: URI (bypass)
Execution
Application renders URL into href attribute
Persist
Victim clicks link, browser strips tab character
Impact
XSS executes in victim browser session
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application calls `Loofah::HTML5::Scrub.allowed_uri?` directly with a user-controlled HTML-encoded string - this is an explicitly non-default usage pattern. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 2.3 (AV:N/AC:H/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L) accurately captures the constrained attack surface: the vulnerability is network-reachable but requires high attack complexity because exploitation depends on a non-default application pattern - directly calling `allowed_uri?` with HTML-encoded strings rather than routing through `sanitize()`. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker submits the URL `java	script:alert(document.cookie)` through a feature that calls `Loofah::HTML5::Scrub.allowed_uri?` directly, such as Action Text 8.2 markdown link validation. The method returns `true` because `CGI.unescapeHTML` leaves `	` intact and the scheme regex does not match `javascript:`. …
Remediation Upgrade to Loofah 2.25.2, which is the vendor-released patch resolving this issue. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Loofah

View all
CVE-2022-23518 MEDIUM POC
6.1 Dec 14

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Rated medium severity (CVSS 6.1
CVE-2022-23516 HIGH
7.5 Dec 14

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri
CVE-2022-23514 HIGH
7.5 Dec 14

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri
CVE-2022-23515 MEDIUM
6.1 Dec 14

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri
CVE-2018-8048 MEDIUM
6.1 Mar 27

In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing

CVE-2019-15587 MEDIUM
5.4 Oct 22

In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG elemen
CVE-2018-16468 MEDIUM
5.4 Oct 30

In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG elem
CVE-2026-73490 MEDIUM
4.7 Aug 12

SVG href attribute bypass in Loofah prior to 2.25.2 allows a crafted sanitized SVG to reference arbitrary same-origin ex
CVE-2026-73492 LOW
2.3 Aug 12

Cross-site scripting in Loofah 2.25.0-2.25.1 is possible when applications call `Loofah::HTML5::Scrub.allowed_uri?` dire

Same weakness CWE-184 – Incomplete List of Disallowed Inputs

View all
CVE-2026-34415 CRITICAL POC
9.3
CVE-2026-41264 CRITICAL POC
9.2
CVE-2026-70470 CRITICAL POC
9.5
CVE-2024-5217 CRITICAL POC
9.2
CVE-2023-2017 HIGH POC
8.8
CVE-2023-29003 HIGH POC
8.8
CVE-2021-25631 HIGH POC
8.8
CVE-2018-6383 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-73491 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy