CVE-2026-73492CWE-184CWE-79cross-site-scripting

CVE-2026-73492

published August 13, 2026

CVSS
2.3
EPSS
0%
Percentile
32.5
In the wild
Unconfirmed
What it is

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as &#58, &#9, &#10, or &#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

The record
Technical detail
CVSS
2.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00394 · 32.5th percentile
Weaknesses
CWE-184 · Incomplete List of Disallowed Inputs; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-13T02:17Z
References (4)
https://github.com/flavorjones/loofah/commit/f1be9d893b5a8dd79240441a912d8897e74c38c0 · [email protected]https://github.com/flavorjones/loofah/pull/308 · [email protected]https://github.com/flavorjones/loofah/releases/tag/v2.25.2 · [email protected]https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2 · [email protected]
EPSS history
Timeline
  • 12 AUG 21:00Z
    Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons
    cvelistv5