SB20261106103 - Multiple vulnerabilities in Loofah

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261106103

SB20261106103 - Multiple vulnerabilities in Loofah

Published: November 6, 2026

Security Bulletin ID SB20261106103
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an unauthenticated remote attacker to execute scripts in another user's browser through mutation cross-site scripting.

The vulnerability exists due to Nokogiri leaving angle brackets unescaped in attribute values emitted by Loofah's HTML5 scrubbers when processing crafted MathML. An unauthenticated remote attacker can submit malicious HTML to an application using the affected HTML5 sanitization API, causing markup inside an allowed attribute to become executable HTML when a victim views the sanitized result.


2) Improper Handling of Case Sensitivity (CVE-ID: N/A)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to expose a viewer's IP address, user agent, and referrer through attacker-directed requests.

The vulnerability exists due to incomplete local-reference checks for SVG textPath and mpath elements in Loofah's default allowlist, also reused by rails-html-sanitizer when SVG is permitted. An unauthenticated remote attacker can submit SVG containing external references that survive sanitization and trigger requests to attacker-chosen URLs, including viewer-network hosts, when a victim views the content in Firefox.


3) Inefficient regular expression complexity (CVE-ID: N/A)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to degrade application availability through excessive CPU consumption.

The vulnerability exists due to quadratic regular expression matching in Loofah's HTML5 sanitizer SVG local-reference check on JRuby or CRuby without linear-time matching. An unauthenticated remote attacker can submit HTML containing an SVG reference element with a long, newline-containing whitespace value in its href or xlink:href attribute, triggering excessive processing under the default configuration.


4) Incorrect Behavior Order: Validate Before Canonicalize (CVE-ID: N/A)

CWE-ID: CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to trigger browser requests that disclose a viewer's IP address, user agent, and access timing.

The vulnerability exists due to Loofah's CSS sanitizer checking for prohibited URLs before decoding escaped parentheses in style attributes. An unauthenticated remote attacker can submit crafted HTML to applications using Loofah's default allowlist and cause requests to attacker-chosen URLs when another user views the sanitized content.


5) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an unauthenticated remote attacker to execute script in a victim's browser through cross-site scripting.

The vulnerability exists due to incomplete HTML entity decoding in Loofah's public allowed_uri? string-level helper, which misclassifies HTML-encoded data URIs as safe plain text. An unauthenticated remote attacker can submit a data:text/html URL to applications that validate encoded strings with this helper and render approved URLs into browser-interpreted attributes, triggering script execution when a victim follows the URL.


Remediation

Install update from vendor's website.

References