CVE-2026-126209

Name of the Vulnerable Software and Affected Versions Loofah versions 2.25.0 through 2.25.2

Description Loofah is a library for manipulating and transforming HTML/XML documents. The Loofah::HTML5::Scrub.allowed uri? helper strips whitespace and control characters before decoding numeric character references that lack a trailing semicolon. This process can hide javascript: or vbscript: schemes by altering where the reference ends, which a browser then reconstructs. This bypass occurs when encoded colons or scheme letters are followed by a stripped character. Applications that use this helper to validate user-controlled URLs and then render them in href or other browser-interpreted URI attributes may allow cross-site scripting. This issue also affects Rails::HTML::Sanitizer.allowed uri? as it re-exports the affected helper.

Recommendations Update Loofah to version 2.25.3 or later.