HTML/XML Manipulation Vulnerability in Loofah Library by Flavorjones

CVE-2026-73491

What is CVE-2026-73491?

The Loofah library, used for manipulating HTML and XML, had a vulnerability affecting versions 2.25.0 to 2.25.2. The issue arises in the allowed_uri? method, where it fails to properly reject certain javascript: URIs that are prefixed with HTML5 named whitespace character references like or . As a result, attackers could exploit this flaw by injecting malicious javascript through HTML-encoded strings. While Loofah's default sanitize path remains unaffected, developers who directly pass HTML-encoded strings to allowed_uri? must update to version 2.25.2 to mitigate this security risk.

References