CVE-2026-126209

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.3, Loofah::HTML5::Scrub.allowed_uri? strips whitespace and control characters before decoding a semicolon-less numeric character reference, changing where the reference ends and hiding a javascript: or vbscript: scheme that a browser reconstructs. The bypass applies to encoded colons and encoded scheme letters when a stripped character terminates the numeric reference. An application that renders the approved value in href or another browser-interpreted URI attribute can allow cross-site scripting, and Rails::HTML::Sanitizer.allowed_uri? re-exports the affected helper. Loofah's default sanitize() path is not affected because Nokogiri decodes entities before URI evaluation. This issue is fixed in version 2.25.3.

• CWE-79
• CWE-184

• https://github.com/flavorjones/loofah/commit/62c04841e8252a1b5373afcd2b89fb9b8279e317
• https://github.com/flavorjones/loofah/pull/324
• https://github.com/flavorjones/loofah/releases/tag/v2.25.3
• https://github.com/flavorjones/loofah/security/advisories/GHSA-p9wj-w8xq-vjx6

Published

Nov 12, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126203Loofah is a general library for manipulating and transformin…6.1
• CVE-2026-126204express-rate-limit is a basic rate-limiting middleware for E…3.7
• CVE-2026-126205Loofah is a general library for manipulating and transformin…5.3
• CVE-2026-126206Loofah is a general library for manipulating and transformin…5.3
• CVE-2026-126207Loofah is a general library for manipulating and transformin…4.7
• CVE-2026-126208Loofah is a general library for manipulating and transformin…4.7
• CVE-2026-12621Improper neutralization of input during web page generation …5.4
• CVE-2026-126210@hono/node-server allows running the Hono application on Nod…5.3
• CVE-2026-126211A improper privilege management vulnerability in Fortinet Fo…7.2
• CVE-2026-126212A heap-based buffer overflow vulnerability in Fortinet Forti…7.2
• CVE-2026-126213A improper neutralization of special elements used in an sql…7.1
• CVE-2026-126214A authentication bypass by spoofing vulnerability in Fortine…7.2