SVG Manipulation Issue in Loofah Library Affecting Web Applications

CVE-2026-126208

What is CVE-2026-126208?

The Loofah library, essential for HTML and XML processing, had a flaw due to an inadequate safelist for its SVG_ALLOW_LOCAL_HREF feature. Specifically, prior to version 2.25.3, the safelist's handling of textPath elements using lowercase spelling conflicted with the HTML5 parser's expectations, leaving certain attributes, such as href and xlink:href, unsanitized. This allowed for the potential exposure of sensitive user data, including IP addresses and user agent details, particularly when content rendering was performed in Firefox. Although Chrome and WebKit browsers mitigated this risk by not fetching these external references, the vulnerability still posed a threat when SVG elements were allowed through the rails-html-sanitizer's PermitScrubber mechanism. The issue has been addressed in version 2.25.3.

References