Incorrect Behavior Order: Validate Before Canonicalize in Loofah - #VU159824
Published: November 6, 2026
Vulnerability identifier: #VU159824
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-180
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to trigger browser requests that disclose a viewer's IP address, user agent, and access timing.
The vulnerability exists due to Loofah's CSS sanitizer checking for prohibited URLs before decoding escaped parentheses in style attributes. An unauthenticated remote attacker can submit crafted HTML to applications using Loofah's default allowlist and cause requests to attacker-chosen URLs when another user views the sanitized content.
Affected software
Loofah
Remediation
Install security update from vendor's website.
Loofah - update to 2.25.3