LOOFAH · CVE-2026-126206 · Package
FIX → 2.25.3
Loofah's allowed_uri? helper accepts a data: URI whose media type is written with the / named entity, treating it as safe text/plain while browsers read it as text/html. An attacker can pass a script-capable data URL through the check and get cross-site scripting when the approved value is rendered into an href.
first public Nov 2, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only applications that call the public allowed_uri? helper on user-controlled URLs with HTML-encoded input and then render the result into an href or similar attribute. The default sanitize() path is not affected, according to the advisory, so applications using only sanitize() can skip it.
Not affected if default-sanitize-only, no-allowed-uri-calls
Who cares loofah, rails, ruby
grep -i loofah Gemfile.lock, and compare it to the affected version 2.25.2.Loofah::HTML5::Scrub.allowed_uri? or Rails::HTML::Sanitizer.allowed_uri? on user-supplied URLs.Upgrade to 2.25.3
Loofah::HTML5::Scrub.allowed_uri? returns true for a data: URI whose mediatype is written with the HTML5 named character reference / in place of the solidus. Loofah reads that mediatype as malformed and falls back to the allowed text/plain, while a browser decodes the reference and reads the same URI as text/html.
allowed_uri? decodes HTML entities with CGI.unescapeHTML, which handles numeric character references but not HTML5 named character references. / therefore survives normalization, so the mediatype carries no /, fails the MIME grammar, and falls back to the allowed text/plain under the WHATWG rule for a malformed mediatype.
:, , and are the only named character references in the HTML5 table that decode to characters that change how a URI parses (U+003A, U+002F, U+0009 and U+000A; there is no named reference for U+000D), so this closes the set.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
loofah 2.25.3 (per the affected range 2.25.2 fixed in 2.25.3; upgrade to Loofah >= 2.25.3)./	
Loofah's default sanitize() path is not affected, because Nokogiri decodes the entity during parsing before Loofah evaluates the URI. This issue affects only callers of the public allowed_uri? string-level helper that pass it HTML-encoded strings.
Applications that validate a user-controlled URL with Loofah::HTML5::Scrub.allowed_uri? and then render the approved value into an href or another browser-interpreted URI attribute may be vulnerable to cross-site scripting. Rails::HTML::Sanitizer.allowed_uri? re-exports the same helper.
Upgrade to Loofah >= 2.25.3.
Responsibly reported by GitHub user @ngpestelos.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.