Skip to main content

Loofah EUVDEUVD-2026-57626

| CVE-2026-73490 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-08-12 GitHub_M
XSS Loofah Red Hat Suse
4.7
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
4.7 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
vuln.today AI
4.7 MEDIUM

AC:H reflects the same-origin attacker-controlled document prerequisite; S:C captures cross-document script execution escaping the sanitized context.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
4.7 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Patch available
Aug 12, 2026 - 22:03 EUVD
Source Code Evidence Fetched
Aug 12, 2026 - 21:45 vuln.today
Analysis Generated
Aug 12, 2026 - 21:45 vuln.today

DescriptionCVE.org

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept the plain href attribute. A crafted sanitized SVG can therefore reference an arbitrary same-origin external document; use may render external SVG content containing scripts or other dangerous content, and feImage may load external images for tracking. Applications that sanitize user-supplied SVG with Loofah's default allowlist are affected. This issue is fixed in version 2.25.2.

AnalysisAI

SVG href attribute bypass in Loofah prior to 2.25.2 allows a crafted sanitized SVG to reference arbitrary same-origin external documents, defeating the HTML5 sanitizer's local-reference restriction. Applications accepting user-supplied SVG content and rendering it to other users are directly affected: SVG use elements can load and render same-origin external SVG containing scripts, while feImage elements can silently fetch external images for tracking. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Attacker places malicious SVG content at a same-origin URL
Delivery
Craft SVG payload with use href referencing that same-origin document
Exploit
Submit crafted SVG through application user-content input
Install
Loofah sanitizer passes href attribute unchecked
C2
Victim browses to page rendering sanitized SVG
Execute
Browser fetches and renders referenced same-origin SVG
Impact
Embedded scripts execute in victim's session context
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three concurrent conditions: the application must accept user-supplied SVG content (directly or SVG embedded in HTML) and sanitize it with Loofah's default allowlist; the sanitized SVG must be rendered to other users (stored XSS scenario - self-XSS does not constitute meaningful impact); and the attacker must be able to place or influence a document at the same origin as the target application to serve as the malicious SVG reference target. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 score of 4.7 (Medium) captures the constrained real-world impact well: AC:H reflects the requirement for a same-origin attacker-controlled document to exist at the target application's origin, and UI:R means a victim must render the crafted SVG. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts an SVG payload containing a use element with href pointing to a same-origin path under their indirect control - for example, a previously uploaded file, a predictable user-content URL, or a separately exploited open redirect - and submits it via the application's user content input. Loofah sanitizes the SVG but passes the href attribute through unchecked, as only xlink:href was restricted. …
Remediation Upgrade Loofah to version 2.25.2 or later, confirmed fixed in the GitHub release at https://github.com/flavorjones/loofah/releases/tag/v2.25.2. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Loofah

View all
CVE-2022-23518 MEDIUM POC
6.1 Dec 14

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Rated medium severity (CVSS 6.1
CVE-2022-23516 HIGH
7.5 Dec 14

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri
CVE-2022-23514 HIGH
7.5 Dec 14

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri
CVE-2022-23515 MEDIUM
6.1 Dec 14

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri
CVE-2018-8048 MEDIUM
6.1 Mar 27

In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing

CVE-2019-15587 MEDIUM
5.4 Oct 22

In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG elemen
CVE-2018-16468 MEDIUM
5.4 Oct 30

In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG elem
CVE-2026-73492 LOW
2.3 Aug 12

Cross-site scripting in Loofah 2.25.0-2.25.1 is possible when applications call `Loofah::HTML5::Scrub.allowed_uri?` dire
CVE-2026-73491 LOW
2.3 Aug 12

Cross-site scripting bypass in Loofah 2.25.0-2.25.1 allows attackers to smuggle `javascript:` URIs past the `allowed_uri

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected
SUSE Linux Enterprise High Availability Extension 16.1 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

EUVD-2026-57626 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy