Loofah CVE-2026-73492

Exploitation requires the application to call Loofah::HTML5::Scrub.allowed_uri? directly with a user-controlled, HTML-encoded URI string - either through custom application code or via Action Text 8.2's markdown link validation, which uses this method internally. Loofah's default sanitize() path is explicitly not affected: Nokogiri decodes or entity-escapes HTML entities during DOM construction before Loofah evaluates the URI scheme, eliminating the CGI/browser decoding discrepancy. Affected Loofah versions are limited to 2.25.0 and 2.25.1 only. For XSS execution to occur, a victim user must subsequently load a page containing the attacker-controlled href attribute - the CVSS 4.0 PR:L metric indicates some level of application access is required to submit input that reaches allowed_uri?. No privileged server access or non-standard network position is required.

The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 2.3) reflects the narrow attack surface accurately: high attack complexity is warranted because exploitation is gated on a non-default, direct call to allowed_uri? with HTML-encoded input, a pattern absent from Loofah's standard sanitize() pipeline. Real-world impact is confined to applications that explicitly invoke this string-level helper - or that depend on Action Text 8.2's markdown link validation - while running Loofah 2.25.0 or 2.25.1, an extremely narrow version window. There is no CISA KEV listing and no public exploit code has been identified; EPSS data was not provided, so exploitation probability cannot be quantified. The subsequent-system XSS impact (SC:L/SI:L) is genuine for affected callers but does not translate to server compromise. The overall risk profile is low-to-moderate for the rare application that hits the vulnerable code path, and negligible for the vast majority of Loofah consumers using sanitize(). Remediation is straightforward and has no functional side effects.

An attacker submits a crafted URL such as javascript&#58alert(document.cookie) or java&#9script:alert(1) to a web application that validates it with Loofah::HTML5::Scrub.allowed_uri? - for example, via a markdown link in an Action Text rich-text field. Because CGI.unescapeHTML leaves &#58 and &#9 encoded, the scheme-detection regex finds no recognized protocol and allowed_uri? returns true. The application stores and later renders the approved URL in an href attribute; when a victim loads the page, their browser decodes the numeric character reference to a literal colon or strips the whitespace, resolving the URL to javascript:alert(document.cookie) and executing the payload in the victim's browser session.