CVE-2026-126203 · Package
NO FIX YET · SEE WHAT TO DO
Loofah's HTML5 sanitizing APIs can emit output that a browser reparses as different, live HTML when used with Nokogiri before 1.19.5. An attacker who controls input that gets sanitized can use MathML inside an allowed attribute to inject markup that runs in the browser.
first public Nov 2, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use Loofah's HTML5 APIs (Loofah.html5_fragment, Loofah.html5_document, or scrub_html5_*) with Nokogiri before 1.19.5 and then render the output in a browser. The :strip scrubber is affected in all browsers; :prune and :escape are affected in WebKit browsers. HTML4 APIs, Loofah::Helpers.sanitize, :whitewash, rails-html-sanitizer's default configuration, and JRuby are not affected, so teams on those paths can skip it.
Not affected if default-rails-html-sanitizer, html4-apis-only, jruby, whitewash-scrubber
Who cares loofah, nokogiri, rails, rails-html-sanitizer, ruby
Gemfile.lock for loofah 2.21.0 through 2.25.2.Gemfile.lock for nokogiri below 1.19.5.Loofah.html5_fragment, Loofah.html5_document, or that use the , , or scrubbers.Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5_fragment, Loofah.html5_document, and the scrub_html5_* methods can emit sanitized output that a browser reparses as different markup when used with Nokogiri before 1.19.5, because those Nokogiri versions do not escape angle brackets in attribute values. MathML can place markup inside an allowed attribute so the reparsed output becomes live HTML. The :strip scrubber is affected in every browser, while :prune and :escape are affected in WebKit browsers. Loofah's HTML4 APIs, Loofah::Helpers.sanitize, :whitewash, rails-html-sanitizer's default configuration, and JRuby are not affected. This issue is fixed in version 2.25.3.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
scrub_html5_*:strip:prune:escapeloofah 2.25.31.19.5 or later, per the advisory's note that earlier Nokogiri versions do not escape attribute valuesNVD data is provided by NIST and is public domain. Posts quoted belong to their authors.