Security Flaw in Loofah Library Affecting HTML/XML Manipulation

CVE-2026-73492

What is CVE-2026-73492?

The Loofah library, used for manipulating HTML and XML documents, has a vulnerability in versions 2.25.0 to 2.25.2. Specifically, the method Loofah::HTML5::Scrub.allowed_uri? fails to properly reject malformed javascript: and vbscript: URIs that use numeric character references without semicolons, such as &#58, &#9, &#10, or &#13. This flaw occurs because CGI.unescapeHTML leaves these numeric references encoded, leading to the dangerous scenario where browsers may decode the input and execute the unauthorized URI schemes. It should be noted that this issue affects only the direct use of HTML-encoded strings with allowed_uri?; however, the standard sanitize() method in Loofah is unaffected. Users are encouraged to upgrade to version 2.25.2 to mitigate this risk.

References