flavorjones Loofah up to 2.25.1 HTML5 Scrub Scrub.allowed_uri? HTML injection

Summaryinfo

A vulnerability classified as problematic was found in flavorjones Loofah up to 2.25.1. Impacted is the function Loofah::HTML5::Scrub.allowed_uri? of the component HTML5 Scrub. Executing a manipulation can lead to HTML injection. The identification of this vulnerability is CVE-2026-73491. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in flavorjones Loofah up to 2.25.1. It has been declared as problematic. This vulnerability affects the function Loofah::HTML5::Scrub.allowed_uri? of the component HTML5 Scrub. The manipulation with an unknown input leads to a html injection vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character references 	 or 
. CGI.unescapeHTML leaves those references intact, so allowed_uri? reports the URL safe even though a browser decodes and strips the tab or line feed and executes the resulting javascript: URL. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-73491 since 08/12/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading to version 2.25.2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• flavorjones

Name

• Loofah

Version

• 2.25.0
• 2.25.1

Website

• Product: https://github.com/flavorjones/loofah/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion