CVE-2026-126203
Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values
CVE-2026-126203 is a medium vulnerability (CVSS 6.1) in Flavorjones Loofah, published November 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in loofah 2.25.3.
- Severity
- 6.1 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.27%EPSS, 19th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.25.3loofah +8 more
Description
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5_fragment, Loofah.html5_document, and the scrub_html5_* methods can emit sanitized output that a browser reparses as different markup when used with Nokogiri before 1.19.5, because those Nokogiri versions do not escape angle brackets in attribute values. MathML can place markup inside an allowed attribute so the reparsed output becomes live HTML. The :strip scrubber is affected in every browser, while :prune and :escape are affected in WebKit browsers. Loofah's HTML4 APIs, Loofah::Helpers.sanitize, :whitewash, rails-html-sanitizer's default configuration, and JRuby are not affected. This issue is fixed in version 2.25.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
loofahRubyGems | 2.21.0 up to 2.25.3 | 2.25.3 |
loofahRubyGems | 2.21.0 up to 2.25.3, plus listed versions 2.21.12.21.22.21.32.21.42.22.0 Show 7 moreShow less2.23.02.23.12.24.02.24.12.25.02.25.12.25.2 | 2.25.3 |
ruby-loofahUbuntu:16.04:LTS | All versions, plus listed versions 2.0.2-12.0.3-12.0.3-22.0.3-2+deb9u1build0.16.04.12.0.3-2+deb9u2build0.16.04.12.0.3-2+deb9u3build0.16.04.1 | None known |
ruby-loofahUbuntu:18.04:LTS | All versions, plus listed versions 2.0.3-22.2.2-1 | None known |
ruby-loofahUbuntu:20.04:LTS | All versions, plus listed versions 2.2.3-12.3.1+dfsg-12.4.0+dfsg-1 | None known |
ruby-loofahUbuntu:22.04:LTS | All versions, plus listed versions 2.12.0-12.13.0-12.13.0-2 | None known |
ruby-loofahUbuntu:24.04:LTS | All versions, plus listed versions 2.21.3-12.21.4-12.22.0-1 | None known |
ruby-loofahUbuntu:26.10 | All versions, plus listed versions 2.25.0-12.25.1-22.25.2-1 | None known |
ruby-loofahUbuntu:26.04:LTS | All versions, plus listed versions 2.24.1-12.25.0-1 | None known |
What each source reports
CVE List Score used
Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5_fragment, Loofah.html5_document, and the scrub_html5_* methods can emit sanitized output that a browser reparses as different markup when used with Nokogiri before 1.19.5, because those Nokogiri versions do not escape angle brackets in attribute values. MathML can place markup inside an allowed attribute so the reparsed output becomes live HTML. The :strip scrubber is affected in every browser, while :prune and :escape are affected in WebKit browsers. Loofah's HTML4 APIs, Loofah::Helpers.sanitize, :whitewash, rails-html-sanitizer's default configuration, and JRuby are not affected. This issue is fixed in version 2.25.3.
- Record
CVE-2026-126203- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79, CWE-116
- Updated
- 2026-11-12
EUVDEUVD-2026-124615
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5_fragment, Loofah.html5_document, and the scrub_html5_* methods can emit sanitized output that a browser reparses as different markup when used with Nokogiri before 1.19.5, because those Nokogiri versions do not escape angle brackets in attribute values. MathML can place markup inside an allowed attribute so the reparsed output becomes live HTML. The :strip scrubber is affected in every browser, while :prune and :escape are affected in WebKit browsers. Loofah's HTML4 APIs, Loofah::Helpers.sanitize, :whitewash, rails-html-sanitizer's default configuration, and JRuby are not affected. This issue is fixed in version 2.25.3.
- Record
EUVD-2026-124615- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-12
GitHub AdvisoriesGHSA-h6v6-rg66-fqj4
Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values
Summary
Loofah's HTML5 scrubbers could emit output that a browser parses into different markup, allowing mutation XSS. Nokogiri < 1.19.5 did not escape < and > in attribute values. When the output contained certain MathML, a browser treated markup inside an allowed attribute as live HTML. The :strip scrubber is affected in every browser. The :prune and :escape scrubbers are affected in WebKit browsers such as Safari.
Nokogiri 1.19.5 escapes < and > in attribute values, as the HTML standard requires. Loofah 2.25.3 requires Nokogiri >= 1.19.5.
Impact
Applications that sanitize untrusted HTML with Loofah's HTML5 API (Loofah.html5_fragment, Loofah.html5_document and the scrub_html5_* methods) and display the result to other people are affected, including with the default allowlist.
Not affected: Loofah's HTML4 API (including Loofah::Helpers.sanitize), the :whitewash scrubber, rails-html-sanitizer's default configuration, and JRuby.
Mitigation
Upgrade to Loofah >= 2.25.3, or upgrade Nokogiri to >= 1.19.5.
- Record
GHSA-h6v6-rg66-fqj4- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79, CWE-116
- Updated
- 2026-11-12
NVD
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5_fragment, Loofah.html5_document, and the scrub_html5_* methods can emit sanitized output that a browser reparses as different markup when used with Nokogiri before 1.19.5, because those Nokogiri versions do not escape angle brackets in attribute values. MathML can place markup inside an allowed attribute so the reparsed output becomes live HTML. The :strip scrubber is affected in every browser, while :prune and :escape are affected in WebKit browsers. Loofah's HTML4 APIs, Loofah::Helpers.sanitize, :whitewash, rails-html-sanitizer's default configuration, and JRuby are not affected. This issue is fixed in version 2.25.3.
- Record
CVE-2026-126203- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79, CWE-116
- Updated
- 2026-11-12
OSV
Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5_fragment, Loofah.html5_document, and the scrub_html5_* methods can emit sanitized output that a browser reparses as different markup when used with Nokogiri before 1.19.5, because those Nokogiri versions do not escape angle brackets in attribute values. MathML can place markup inside an allowed attribute so the reparsed output becomes live HTML. The :strip scrubber is affected in every browser, while :prune and :escape are affected in WebKit browsers. Loofah's HTML4 APIs, Loofah::Helpers.sanitize, :whitewash, rails-html-sanitizer's default configuration, and JRuby are not affected. This issue is fixed in version 2.25.3.
- Record
CVE-2026-126203- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-116, CWE-79
- Updated
- 2026-11-14
OSVGHSA-h6v6-rg66-fqj4
Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values
Summary
Loofah's HTML5 scrubbers could emit output that a browser parses into different markup, allowing mutation XSS. Nokogiri < 1.19.5 did not escape < and > in attribute values. When the output contained certain MathML, a browser treated markup inside an allowed attribute as live HTML. The :strip scrubber is affected in every browser. The :prune and :escape scrubbers are affected in WebKit browsers such as Safari.
Nokogiri 1.19.5 escapes < and > in attribute values, as the HTML standard requires. Loofah 2.25.3 requires Nokogiri >= 1.19.5.
Impact
Applications that sanitize untrusted HTML with Loofah's HTML5 API (Loofah.html5_fragment, Loofah.html5_document and the scrub_html5_* methods) and display the result to other people are affected, including with the default allowlist.
Not affected: Loofah's HTML4 API (including Loofah::Helpers.sanitize), the :whitewash scrubber, rails-html-sanitizer's default configuration, and JRuby.
Mitigation
Upgrade to Loofah >= 2.25.3, or upgrade Nokogiri to >= 1.19.5.
- Record
GHSA-h6v6-rg66-fqj4- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-116, CWE-79
- Updated
- 2026-11-12
OSVUBUNTU-CVE-2026-126203
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5_fragment, Loofah.html5_document, and the scrub_html5_* methods can emit sanitized output that a browser reparses as different markup when used with Nokogiri before 1.19.5, because those Nokogiri versions do not escape angle brackets in attribute values. MathML can place markup inside an allowed attribute so the reparsed output becomes live HTML. The :strip scrubber is affected in every browser, while :prune and :escape are affected in WebKit browsers. Loofah's HTML4 APIs, Loofah::Helpers.sanitize, :whitewash, rails-html-sanitizer's default configuration, and JRuby are not affected. This issue is fixed in version 2.25.3.
- Record
UBUNTU-CVE-2026-126203- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-13
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| references | OSV | |
| published | EUVD | |
| published | EUVD, NVD | |
| affected, references | OSV | |
| affected, aliases, facts, references | GitHub Advisories | |
| first indexed | CVE List, EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/flavorjones/loofah/security/advisories/GHSA-h6v6-rg66-fqj4
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-126203
ubuntu.com/security/CVE-2026-126203
cve.org/CVERecord?id=CVE-2026-126203