redhat/rubygem-loofah vulnerabilities

Latest redhat/rubygem-loofah CVEs

Newest publication first

1. CVE-2026-126206 Loofah allowed_uri? treats data:text/html as safe text/plain

   Published 2026-11-12

   Medium·CVSS 5.3

   Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.allowed_uri? treats a data URI mediatype containing the HTML5 named solidus reference / as malformed and falls back to the all...

2. CVE-2026-73492 Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

   Published 2026-08-12

   Low·CVSS 2.3 EPSS 0.39%

   Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric char...

3. CVE-2026-73491 Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

   Published 2026-08-12

   Low·CVSS 2.3 EPSS 0.39%

   Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace...

4. CVE-2026-73490 Loofah: SVG `href` attribute bypasses local-reference restriction

   Published 2026-08-12

   Medium·CVSS 4.7 EPSS 0.30%

   Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while brow...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.