Skip to main content

Loofah CVE-2026-73492

| EUVDEUVD-2026-57629 LOW
Cross-site Scripting (XSS) (CWE-79)
2026-08-12 GitHub_M
XSS Loofah
2.3
CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY
2.3 LOW
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.4 MEDIUM

High complexity because non-default direct API usage is required; user interaction needed for stored XSS to execute; scope change from server to browser context with low confidentiality and integrity impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 12, 2026 - 22:03 EUVD
Source Code Evidence Fetched
Aug 12, 2026 - 21:55 vuln.today
Analysis Generated
Aug 12, 2026 - 21:55 vuln.today

DescriptionCVE.org

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as &#58, &#9, &#10, or &#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

AnalysisAI

Cross-site scripting in Loofah 2.25.0-2.25.1 is possible when applications call Loofah::HTML5::Scrub.allowed_uri? directly with HTML-encoded strings, because the method fails to detect javascript: or vbscript: schemes disguised via semicolon-less numeric character references such as &#58 (colon) or &#9 (tab). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Submit HTML-encoded javascript: URI
Delivery
allowed_uri? misses encoded scheme via CGI gap
Exploit
Application stores approved href
Execution
Victim loads page with injected attribute
Persist
Browser decodes numeric reference
Impact
javascript: payload executes in victim session
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the application to call `Loofah::HTML5::Scrub.allowed_uri?` directly with a user-controlled, HTML-encoded URI string - either through custom application code or via Action Text 8.2's markdown link validation, which uses this method internally. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 2.3) reflects the narrow attack surface accurately: high attack complexity is warranted because exploitation is gated on a non-default, direct call to `allowed_uri?` with HTML-encoded input, a pattern absent from Loofah's standard `sanitize()` pipeline. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker submits a crafted URL such as `javascript&#58alert(document.cookie)` or `java&#9script:alert(1)` to a web application that validates it with `Loofah::HTML5::Scrub.allowed_uri?` - for example, via a markdown link in an Action Text rich-text field. Because `CGI.unescapeHTML` leaves `&#58` and `&#9` encoded, the scheme-detection regex finds no recognized protocol and `allowed_uri?` returns `true`. …
Remediation Upgrade to Loofah 2.25.2, confirmed as the fix release via the official GitHub release tag and GHSA-5qhf-9phg-95m2 advisory (https://github.com/flavorjones/loofah/releases/tag/v2.25.2). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Loofah

View all
CVE-2022-23518 MEDIUM POC
6.1 Dec 14

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Rated medium severity (CVSS 6.1
CVE-2022-23516 HIGH
7.5 Dec 14

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri
CVE-2022-23514 HIGH
7.5 Dec 14

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri
CVE-2022-23515 MEDIUM
6.1 Dec 14

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri
CVE-2018-8048 MEDIUM
6.1 Mar 27

In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing

CVE-2019-15587 MEDIUM
5.4 Oct 22

In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG elemen
CVE-2018-16468 MEDIUM
5.4 Oct 30

In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG elem
CVE-2026-73490 MEDIUM
4.7 Aug 12

SVG href attribute bypass in Loofah prior to 2.25.2 allows a crafted sanitized SVG to reference arbitrary same-origin ex
CVE-2026-73491 LOW
2.3 Aug 12

Cross-site scripting bypass in Loofah 2.25.0-2.25.1 allows attackers to smuggle `javascript:` URIs past the `allowed_uri

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-73492 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy