CVE-2026-126206

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.allowed_uri? treats a data URI mediatype containing the HTML5 named solidus reference / as malformed and falls back to the allowed text/plain, while a browser decodes the reference and interprets the same value as text/html. An application that validates a user-controlled URL with this helper and renders the approved value in href or another browser-interpreted URI attribute can allow cross-site scripting. Rails::HTML::Sanitizer.allowed_uri? re-exports the affected helper. Loofah's default sanitize() path is not affected because Nokogiri decodes the entity before URI validation. This issue is fixed in version 2.25.3.

• CWE-79
• CWE-184

• https://github.com/flavorjones/loofah/commit/ad92002966053309f83b550861e2ef04bc714744
• https://github.com/flavorjones/loofah/pull/324
• https://github.com/flavorjones/loofah/releases/tag/v2.25.3
• https://github.com/flavorjones/loofah/security/advisories/GHSA-jcff-cj73-4w4f

Published

Nov 12, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126199pgEdge Postgres MCP Server enables SQL queries against Postg…6.8
• CVE-2026-1262IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …4.3
• CVE-2026-12620The GridTime 3000 GNSS Time Server leaks the access token in…6.5
• CVE-2026-126203Loofah is a general library for manipulating and transformin…6.1
• CVE-2026-126204express-rate-limit is a basic rate-limiting middleware for E…3.7
• CVE-2026-126205Loofah is a general library for manipulating and transformin…5.3
• CVE-2026-126207Loofah is a general library for manipulating and transformin…4.7
• CVE-2026-126208Loofah is a general library for manipulating and transformin…4.7
• CVE-2026-126209Loofah is a general library for manipulating and transformin…5.3
• CVE-2026-12621Improper neutralization of input during web page generation …5.4
• CVE-2026-126210@hono/node-server allows running the Hono application on Nod…5.3
• CVE-2026-126211A improper privilege management vulnerability in Fortinet Fo…7.2