Cross-Site Scripting Vulnerability in Loofah Library for HTML/XML Manipulation

CVE-2026-126206

What is CVE-2026-126206?

A vulnerability in the Loofah library allows an attacker to exploit a flaw in the handling of data URIs. When validating user-controlled URLs, the helper incorrectly treats certain valid URIs as malformed, which can lead to cross-site scripting attacks when the sanitized values are rendered in href attributes or similar contexts. This is particularly concerning as browsers interpret these values differently, potentially exposing applications to security threats. The issue has been addressed in version 2.25.3 of Loofah, ensuring safer handling of HTML and XML documents.

References