LOOFAH · CVE-2026-126208 · Package
FIX → 2.25.3
Loofah's HTML sanitizer lets external href and xlink:href values survive on SVG textPath and mpath elements. When a user-supplied SVG is rendered in Firefox, the viewer's browser fetches the attacker's URL, leaking IP address, user agent and referrer.
first public Nov 2, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that sanitize user-supplied SVG, directly or inside HTML, using Loofah's default allowlist, or rails-html-sanitizer with SVG elements permitted, are affected. Impact is a network request to an attacker-chosen URL, not script execution. Chrome and WebKit do not fetch external references on these elements.
Not affected if no-user-svg, static-content
Who cares loofah, rails, rails-html-sanitizer, ruby
Gemfile.lock or with bundle list | grep loofahrails-html-sanitizer is in Gemfile.lock and whether PermitScrubber is configured to allow SVG elementsUpgrade to 2.25.3
Loofah restricts href and xlink:href on certain SVG elements to same-document references. Two elements escaped the restriction:
<textPath>: SVG_ALLOW_LOCAL_HREF listed it in lowercase as textpath, but the HTML5 parser names the element textPath inside <svg>, so the check never matched on the HTML5 path.<mpath>: absent from SVG_ALLOW_LOCAL_HREF, so its references were never restricted on either path.rails-html-sanitizer reuses this safelist in its PermitScrubber, so it is affected too.
An external href or on or survives sanitization. Firefox fetches the URL when rendering the content, which leaks the viewer's IP address, user agent, and referrer, and can reach hosts routable only from the viewer's network. Chrome and WebKit do not fetch external references on these elements. The impact is a network request to an attacker-chosen URL, not script execution.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
2.25.3 or laterxlink:href<textPath><mpath>Applications that sanitize user-supplied SVG, directly or inside HTML, with Loofah's default allowlist or with rails-html-sanitizer with SVG elements permitted are affected.
Upgrade to Loofah >= 2.25.3.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.