CVE-2026-73490

Name of the Vulnerable Software and Affected Versions Loofah versions prior to 2.25.2

Description The HTML5 sanitizer in this library incorrectly applies local-reference restrictions only to the xlink:href attribute on SVG use and feImage elements. Because browsers also accept the plain href attribute, a crafted sanitized SVG can reference an arbitrary same-origin external document. This may allow the use element to render external SVG content containing scripts or other dangerous content, and the feImage element to load external images for tracking purposes. Applications using the default allowlist to sanitize user-supplied SVG are affected.

Recommendations Update to version 2.25.2.