CVE-2026-73492None▾ SunlitLoofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose sch…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as :, 	, 
, or 
. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
GHSA-5qhf-9phg-95m2LowLoofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons
CVE-2026-73491Low· 2.3Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri
CVE-2026-73650High· 8.2SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files
CVE-2026-61453MediumGrav: XSS Blueprint Validation Bypass via Twig String Concatenation
CVE-2026-63671High· 8.1MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component
CVE-2026-84370High· 8.2SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files