HTML/XML Manipulation Vulnerability in Loofah Library by Flavorjones

CVE-2026-126205

What is CVE-2026-126205?

The Loofah library, used for manipulating and sanitizing HTML and XML documents, contains a vulnerability prior to version 2.25.3 that affects how href and xlink:href attributes are validated within SVG elements. The vulnerability arises from a regular expression employed during sanitization that is not optimized for multiline whitespace attributes. Specifically, an attacker can craft an SVG reference element that includes a lengthy attribute composed entirely of whitespace, which can result in significant CPU resource consumption due to quadratic time complexity during the sanitization process. This issue is mitigated in versions 2.25.3 and later, which implement a more efficient linear-time matching algorithm.

References