--- id: CVE-2026-73492 title: >- Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri summary: >- Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose sch… severity: none cwe: - CWE-79 - CWE-184 published: '2026-08-12' updated: '2026-09-09' sourceUpdated: '2026-09-09T20:58:37.713' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73492' references: - url: >- https://github.com/flavorjones/loofah/commit/f1be9d893b5a8dd79240441a912d8897e74c38c0 label: security-advisories@github.com - url: 'https://github.com/flavorjones/loofah/pull/308' label: security-advisories@github.com - url: 'https://github.com/flavorjones/loofah/releases/tag/v2.25.2' label: security-advisories@github.com - url: >- https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2 label: security-advisories@github.com tags: - nvd epss: 0.00394 epssPercentile: 0.30909 ingestedAt: '2026-09-09T21:22:45.532Z' --- ## Overview Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as :, , , or . CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges.