HTML/XML Sanitization Vulnerability in Loofah Library by Flavors

CVE-2026-73490

What is CVE-2026-73490?

The Loofah library, which is utilized for manipulating and transforming HTML and XML documents, has a vulnerability affecting its HTML5 sanitizer. This issue arises because, prior to version 2.25.2, the sanitizer inadequately restricts local references in SVG graphics. Specifically, it only applies restrictions on the 'xlink:href' attribute, while overlooking the plain 'href' attribute commonly accepted by browsers. Consequently, this allows for the possibility of crafted sanitized SVGs referencing arbitrary same-origin external documents. This exposure enables potential loading of external scripts or risky content, with security implications such as tracking through the 'feImage' tag. The vulnerability has been addressed in version 2.25.2 of the library.

References