CVE-2026-73491 - Medium Severity Vulnerability
Vulnerable Library - loofah-2.25.1.gem
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments,
built on top of Nokogiri.
Loofah also includes some HTML sanitizers based on html5lib's safelist, which are a specific
application of the general transformation functionality.
Library home page: https://rubygems.org/gems/loofah-2.25.1.gem
Sample Path to Dependency File: /Gemfile.lock
Path to vulnerable library: /tmp/containerbase/cache/.ruby/cache/loofah-2.25.1.gem
Dependency Hierarchy:
- rails-8.0.5.gem (Root Library)
- activestorage-8.0.5.gem
- actionpack-8.0.5.gem
- actionview-8.0.5.gem
- rails-html-sanitizer-1.7.0.gem
- ❌ loofah-2.25.1.gem (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character references or
. CGI.unescapeHTML leaves those references intact, so allowed_uri? reports the URL safe even though a browser decodes and strips the tab or line feed and executes the resulting javascript: URL. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-08-12
URL: CVE-2026-73491
CVSS 3 Score Details (4.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-12
Fix Resolution: https://github.com/flavorjones/loofah.git - v2.25.2
Step up your Open Source Security Game with Mend here
CVE-2026-73491 - Medium Severity Vulnerability
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.
Loofah also includes some HTML sanitizers based on
html5lib's safelist, which are a specificapplication of the general transformation functionality.
Library home page: https://rubygems.org/gems/loofah-2.25.1.gem
Sample Path to Dependency File: /Gemfile.lock
Path to vulnerable library: /tmp/containerbase/cache/.ruby/cache/loofah-2.25.1.gem
Dependency Hierarchy:
Found in base branch: master
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character references or
. CGI.unescapeHTML leaves those references intact, so allowed_uri? reports the URL safe even though a browser decodes and strips the tab or line feed and executes the resulting javascript: URL. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-08-12
URL: CVE-2026-73491
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Release Date: 2026-08-12
Fix Resolution: https://github.com/flavorjones/loofah.git - v2.25.2
Step up your Open Source Security Game with Mend here