Cross-Site Scripting Vulnerability in Loofah Library by Flavorjones

CVE-2026-126209

What is CVE-2026-126209?

The Loofah library, utilized for manipulating and transforming HTML/XML documents, contains a vulnerability that affects versions 2.25.0 to 2.25.3. This issue arises when the Loofah::HTML5::Scrub.allowed_uri? method improperly processes semicolon-less numeric character references. Specifically, it strips whitespace and control characters before decoding these references, which exposes applications to cross-site scripting (XSS) attacks. An attacker can craft a malicious URI that gets improperly rendered in href attributes, enabling scripts to execute in the context of the user's browser. It is advisable to upgrade to version 2.25.3 or later where this vulnerability has been addressed.

References