LOOFAH · CVE-2026-126207 · Package
FIX → 2.25.3
Loofah's CSS sanitizer missed url() calls written with CSS escapes, so a sanitized style attribute can still make a viewer's browser request an attacker-chosen URL. The request leaks the viewer's IP address, user agent and access timing, but no script runs and the response is not readable.
first public Nov 2, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that sanitize user-supplied HTML with Loofah's default allowlist and display it to other people are affected. Apps that do not render sanitized user HTML, or that only handle trusted content, are less exposed. The sources do not say whether other sanitizer configurations are affected.
Not affected if no-user-html, not-displayed-to-others
Who cares loofah, rails, ruby, web-apps
bundle list loofah or check Gemfile.lock for the loofah versionLoofah::HTML5::Scrub or scrub_css to see whether user-supplied HTML is sanitized and shown to other usersUpgrade to 2.25.3
Loofah::HTML5::Scrub.scrub_css rejected any property whose top-level Crass tokens included a :url or :bad_url, and left url out of the allowed CSS functions. Both checks ran only against the first parse of the style attribute. When scrub_css rebuilt each property it emitted identifiers with their CSS escapes decoded, so parentheses written as escapes — url\28 …\29 — hid the url token from the checks, and the rebuilt value was re-parsed into a live url() that nothing checked again. An escaped property name, six-digit escapes, escaped comments and escaped quotes all reached the same place.
A sanitized style attribute could make a viewer's browser issue a request to an attacker-chosen URL. list-style fetches on render with no interaction, cursor on hover. That leaks the viewer's IP address, user agent and access timing, and can reach hosts routable only from the viewer's network. No script survives sanitization and the attacker cannot read the response, so the request itself is the whole impact.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
2.25.3Applications that sanitize user-supplied HTML with Loofah's default allowlist and display it to other people are affected.
Upgrade to Loofah >= 2.25.3.
Reported by NotAFlightRisk through GitHub's private vulnerability reporting.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.