Cross-site scripting in Loofah - #VU159821
Published: November 6, 2026
Vulnerability identifier: #VU159821
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to execute scripts in another user's browser through mutation cross-site scripting.
The vulnerability exists due to Nokogiri leaving angle brackets unescaped in attribute values emitted by Loofah's HTML5 scrubbers when processing crafted MathML. An unauthenticated remote attacker can submit malicious HTML to an application using the affected HTML5 sanitization API, causing markup inside an allowed attribute to become executable HTML when a victim views the sanitized result.
Affected software
Loofah
Remediation
Install security update from vendor's website.
Loofah - update to 2.25.3