CVE-2026-126207

Name of the Vulnerable Software and Affected Versions Loofah versions prior to 2.25.3

Description Loofah is a library for manipulating and transforming HTML/XML documents. The Loofah::HTML5::Scrub.scrub css function only checks the first parse of a style attribute. When rebuilding CSS, identifier escapes are decoded, allowing escaped parentheses, property names, comments, or quotes to become a live url() without a second safety check. An attacker can use the list-style property to trigger a request to a chosen URL when content renders, or the cursor property to trigger a request on hover. This can disclose the viewer's IP address, user agent, access timing, and access to internal-network hosts. No script survives sanitization and the attacker cannot read the response.

Recommendations Update to version 2.25.3 or later.