HTML/XML Manipulation Vulnerability in Loofah Library by Flavorjones
CVE-2026-126203

6.1MEDIUM

Key Information:

Vendor

Flavorjones

Status
Loofah
Vendor
CVE Published:
12 November 2026

What is CVE-2026-126203?

The Loofah library, utilized for manipulating and transforming HTML/XML documents, contains a vulnerability that affects versions 2.21.0 to 2.25.3. Certain HTML5 APIs within Loofah can produce sanitized outputs that are misinterpreted by browsers when used in conjunction with prior versions of Nokogiri (below 1.19.5). This inconsistency arises due to failure to escape angle brackets in attribute values, enabling potential injection of live HTML through attributes in MathML. Browsers may exhibit varying vulnerability levels, with the :strip scrubber affected universally, while :prune and :escape show vulnerabilities specifically in WebKit browsers. However, Loofah’s earlier HTML4 APIs remain unaffected. This issue has been resolved as of version 2.25.3.

Affected Version(s)

loofah >= 2.21.0, < 2.25.3

References

https://github.com/flavorjones/loofah/security/advisories...
x_refsource_CONFIRM
https://github.com/flavorjones/loofah/pull/324
x_refsource_MISC
https://github.com/sparklemotion/nokogiri/pull/3741
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.