SB20261106102 - Multiple vulnerabilities in Loofah

Description

This security bulletin contains information about 3 vulnerabilities.

1) Cross-site scripting (CVE-ID: CVE-2026-73490)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows an unauthenticated remote attacker to execute scripts in the context of a sanitized document viewed by a victim.

The vulnerability exists due to Loofah's HTML5 sanitizer applying local-reference restrictions to SVG xlink:href but not href when sanitizing user-supplied SVG with its default allowlist. An unauthenticated remote attacker can submit an SVG use element referencing a same-origin external SVG containing scripts, potentially causing execution when the victim views the sanitized content.

2) Cross-site scripting (CVE-ID: CVE-2026-73492)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows an unauthenticated remote attacker to execute JavaScript in a victim's browser through cross-site scripting.

The vulnerability exists due to incomplete decoding of numeric character references without trailing semicolons in Loofah's allowed_uri? helper when applications validate HTML-encoded URLs. An unauthenticated remote attacker can submit an encoded malicious URL that passes validation and executes when rendered in a URI attribute and activated by the victim.

3) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-73491)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to execute JavaScript in a victim's browser through applications using Loofah.

The vulnerability exists due to incomplete handling of named whitespace character references in allowed_uri? when callers validate HTML-encoded URLs and render approved values into browser-interpreted URI attributes. An unauthenticated remote attacker can submit a javascript: URL split by 	 or 
 to bypass validation and execute script when a victim follows the rendered link.

Remediation

Install update from vendor's website.

References

• https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf
• https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2
• https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv