CVE-2026-126207

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah::HTML5::Scrub.scrub_css checks only the first parse of a style attribute, then rebuilds CSS with identifier escapes decoded so escaped parentheses, property names, comments, or quotes can become a live url() without a second safety check. An attacker can use list-style to make a viewer's browser request an attacker-chosen URL when content renders, or cursor to make the request on hover. The request can disclose the viewer's IP address, user agent, access timing, and access to internal-network hosts, but no script survives sanitization and the attacker cannot read the response. This issue is fixed in version 2.25.3.

• CWE-180
• CWE-184

• https://github.com/flavorjones/loofah/commit/b198a36e44c9c5408163ac50787825e8ca0b166b
• https://github.com/flavorjones/loofah/pull/324
• https://github.com/flavorjones/loofah/releases/tag/v2.25.3
• https://github.com/flavorjones/loofah/security/advisories/GHSA-m3x9-938q-5767

Published

Nov 12, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1262IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …4.3
• CVE-2026-12620The GridTime 3000 GNSS Time Server leaks the access token in…6.5
• CVE-2026-126203Loofah is a general library for manipulating and transformin…6.1
• CVE-2026-126204express-rate-limit is a basic rate-limiting middleware for E…3.7
• CVE-2026-126205Loofah is a general library for manipulating and transformin…5.3
• CVE-2026-126206Loofah is a general library for manipulating and transformin…5.3
• CVE-2026-126208Loofah is a general library for manipulating and transformin…4.7
• CVE-2026-126209Loofah is a general library for manipulating and transformin…5.3
• CVE-2026-12621Improper neutralization of input during web page generation …5.4
• CVE-2026-126210@hono/node-server allows running the Hono application on Nod…5.3
• CVE-2026-126211A improper privilege management vulnerability in Fortinet Fo…7.2
• CVE-2026-126212A heap-based buffer overflow vulnerability in Fortinet Forti…7.2