CVE-2026-126203

Name of the Vulnerable Software and Affected Versions Loofah versions 2.21.0 through 2.25.2 Nokogiri versions prior to 1.19.5

Description Loofah's HTML5 APIs, specifically Loofah.html5 fragment, Loofah.html5 document, and the scrub html5 * methods, can produce sanitized output that browsers reparse as different markup, leading to mutation XSS (Cross-Site Scripting). This occurs when used with Nokogiri versions that do not escape angle brackets in attribute values. Specifically, MathML can be used to place markup inside an allowed attribute, which the browser then treats as live HTML. The :strip scrubber is affected across all browsers, while the :prune and :escape scrubbers are affected in WebKit browsers, such as Safari.

Recommendations Update Loofah to version 2.25.3 or later. Update Nokogiri to version 1.19.5 or later.