Loofah EUVD-2026-57626

Exploitation requires three concurrent conditions: the application must accept user-supplied SVG content (directly or SVG embedded in HTML) and sanitize it with Loofah's default allowlist; the sanitized SVG must be rendered to other users (stored XSS scenario - self-XSS does not constitute meaningful impact); and the attacker must be able to place or influence a document at the same origin as the target application to serve as the malicious SVG reference target. Modern browsers enforce strict cross-origin restrictions on SVG use fetches, so purely attacker-hosted external documents cannot be loaded for script execution purposes - the same-origin constraint is a hard limit on scope. For feImage, cross-origin image loading may succeed for tracking purposes but does not enable script execution. Exploitation is further gated by User Interaction (UI:R): a victim must browse to the page rendering the crafted SVG. No special authentication is required to submit or view content, per CVSS PR:N, but the attacker's need to control a same-origin resource substantially raises practical complexity beyond what raw CVSS reflects.

The CVSS 3.1 score of 4.7 (Medium) captures the constrained real-world impact well: AC:H reflects the requirement for a same-origin attacker-controlled document to exist at the target application's origin, and UI:R means a victim must render the crafted SVG. The Changed Scope (S:C) is the most significant signal - this is a security-control bypass where the sanitizer is specifically trusted to make content safe for rendering, and that trust is violated. No EPSS data was provided, so exploitation probability cannot be quantified numerically. There is no CISA KEV listing and no public POC has been identified at time of analysis. Despite the moderate CVSS score, organizations that deploy Loofah precisely as a sanitization boundary - even a mid-sized municipal IT team in zabrze running a community-facing Rails application that accepts user SVG uploads - should treat this as urgent, because the sanitizer's fundamental guarantee is broken for this vector. The additional URI normalization fixes bundled in 2.25.2 (numeric character references, 	/
 whitespace) suggest the maintainer identified a broader class of evasion risk during the audit, beyond the headline href gap; these do not appear to carry separate CVE assignments but reinforce the importance of upgrading rather than patching piecemeal.

An attacker crafts an SVG payload containing a use element with href pointing to a same-origin path under their indirect control - for example, a previously uploaded file, a predictable user-content URL, or a separately exploited open redirect - and submits it via the application's user content input. Loofah sanitizes the SVG but passes the href attribute through unchecked, as only xlink:href was restricted. When a victim browses the page rendering the sanitized output, their browser fetches the same-origin referenced SVG and executes any scripts contained within it in the context of the victim's authenticated session, enabling session hijacking or data exfiltration. No public POC has been identified at time of analysis, but the bypass requires only substituting href for xlink:href in a standard SVG use payload.