CVE-2026-126206

Name of the Vulnerable Software and Affected Versions Loofah versions prior to 2.25.3

Description Loofah is a library for manipulating and transforming HTML/XML documents. The Loofah::HTML5::Scrub.allowed uri? function (also re-exported by Rails::HTML::Sanitizer.allowed uri?) incorrectly handles data URIs containing the HTML5 named solidus reference /. Because the function uses CGI.unescapeHTML, which does not support HTML5 named character references, the / reference is not decoded. This causes the mediatype to be treated as malformed, leading the system to fall back to the allowed text/plain type. However, web browsers decode the reference and interpret the URI as text/html. Applications that use this helper to validate user-controlled URLs and then render them in href or other browser-interpreted URI attributes may be susceptible to cross-site scripting. This issue specifically affects callers of the allowed uri? helper passing HTML-encoded strings; the default sanitize() path is not affected.

Recommendations Update Loofah to version 2.25.3 or later.