Cross-Site Scripting in Loofah HTML/XML Library from Flavorjones

CVE-2026-126207

What is CVE-2026-126207?

The Loofah library, essential for manipulating HTML/XML documents, contains a vulnerability prior to version 2.25.3. This flaw lies in the Loofah::HTML5::Scrub.scrub_css method, where it inadequately checks the CSS styles, leading to potential exploitation by attackers. By manipulating CSS properties such as list-style or cursor, an attacker can craft URLs that cause the viewer's browser to make unintended requests. While the exposure allows the attacker to glean sensitive information such as the viewer's IP address, user agent, and access timing, the attacker cannot retrieve the server responses due to effective sanitization processes post-exploitation. The vulnerability was addressed in version 2.25.3, emphasizing the need for users to upgrade to this version to safeguard against these risks.

References