CVE-2026-126208
Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction
CVE-2026-126208 is a medium vulnerability (CVSS 4.7) in Flavorjones Loofah, published November 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in loofah 2.25.3.
- Severity
- 4.7 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.36%EPSS, 30th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.25.3loofah +8 more
Description
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG_ALLOW_LOCAL_HREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external href and xlink:href values on those elements survive sanitization. Firefox fetches the attacker-chosen URL when a viewer renders the content, which can disclose the viewer's IP address, user agent, referrer, and access to hosts routable only from the viewer's network. Chrome and WebKit do not fetch these references, and the impact is a network request rather than script execution. The rails-html-sanitizer PermitScrubber reuses the affected safelist when SVG elements are permitted. This issue is fixed in version 2.25.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
loofahRubyGems | before 2.25.3 | 2.25.3 |
loofahRubyGems | before 2.25.3, plus listed versions 0.2.00.2.10.2.20.3.00.3.1 Show 45 moreShow less0.4.00.4.10.4.20.4.30.4.40.4.50.4.60.4.71.0.01.0.0.beta.11.1.01.2.01.2.12.0.02.0.12.0.22.0.32.1.02.1.0.rc12.1.0.rc22.1.12.10.02.11.02.12.02.13.02.14.02.15.02.16.02.17.02.18.02.19.02.19.12.2.02.2.12.2.22.2.32.20.02.21.02.21.0.rc12.21.12.21.22.21.32.21.42.22.02.23.0 | 2.25.3 |
ruby-loofahUbuntu:16.04:LTS | All versions, plus listed versions 2.0.2-12.0.3-12.0.3-22.0.3-2+deb9u1build0.16.04.12.0.3-2+deb9u2build0.16.04.12.0.3-2+deb9u3build0.16.04.1 | None known |
ruby-loofahUbuntu:18.04:LTS | All versions, plus listed versions 2.0.3-22.2.2-1 | None known |
ruby-loofahUbuntu:20.04:LTS | All versions, plus listed versions 2.2.3-12.3.1+dfsg-12.4.0+dfsg-1 | None known |
ruby-loofahUbuntu:22.04:LTS | All versions, plus listed versions 2.12.0-12.13.0-12.13.0-2 | None known |
ruby-loofahUbuntu:24.04:LTS | All versions, plus listed versions 2.21.3-12.21.4-12.22.0-1 | None known |
ruby-loofahUbuntu:26.10 | All versions, plus listed versions 2.25.0-12.25.1-22.25.2-1 | None known |
ruby-loofahUbuntu:26.04:LTS | All versions, plus listed versions 2.24.1-12.25.0-1 | None known |
What each source reports
CVE List Score used
Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG_ALLOW_LOCAL_HREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external href and xlink:href values on those elements survive sanitization. Firefox fetches the attacker-chosen URL when a viewer renders the content, which can disclose the viewer's IP address, user agent, referrer, and access to hosts routable only from the viewer's network. Chrome and WebKit do not fetch these references, and the impact is a network request rather than script execution. The rails-html-sanitizer PermitScrubber reuses the affected safelist when SVG elements are permitted. This issue is fixed in version 2.25.3.
- Record
CVE-2026-126208- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-178, CWE-184
- Updated
- 2026-11-12
EUVDEUVD-2026-124715
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG_ALLOW_LOCAL_HREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external href and xlink:href values on those elements survive sanitization. Firefox fetches the attacker-chosen URL when a viewer renders the content, which can disclose the viewer's IP address, user agent, referrer, and access to hosts routable only from the viewer's network. Chrome and WebKit do not fetch these references, and the impact is a network request rather than script execution. The rails-html-sanitizer PermitScrubber reuses the affected safelist when SVG elements are permitted. This issue is fixed in version 2.25.3.
- Record
EUVD-2026-124715- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Updated
- 2026-11-12
GitHub AdvisoriesGHSA-345x-3rq2-jfrm
Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction
Summary
Loofah restricts href and xlink:href on certain SVG elements to same-document references. Two elements escaped the restriction:
<textPath>:SVG_ALLOW_LOCAL_HREFlisted it in lowercase astextpath, but the HTML5 parser names the elementtextPathinside<svg>, so the check never matched on the HTML5 path.<mpath>: absent fromSVG_ALLOW_LOCAL_HREF, so its references were never restricted on either path.
rails-html-sanitizer reuses this safelist in its PermitScrubber, so it is affected too.
Impact
An external href or xlink:href on <textPath> or <mpath> survives sanitization. Firefox fetches the URL when rendering the content, which leaks the viewer's IP address, user agent, and referrer, and can reach hosts routable only from the viewer's network. Chrome and WebKit do not fetch external references on these elements. The impact is a network request to an attacker-chosen URL, not script execution.
Applications that sanitize user-supplied SVG, directly or inside HTML, with Loofah's default allowlist or with rails-html-sanitizer with SVG elements permitted are affected.
Mitigation
Upgrade to Loofah >= 2.25.3.
- Record
GHSA-345x-3rq2-jfrm- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-178, CWE-184
- Updated
- 2026-11-12
NVD
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG_ALLOW_LOCAL_HREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external href and xlink:href values on those elements survive sanitization. Firefox fetches the attacker-chosen URL when a viewer renders the content, which can disclose the viewer's IP address, user agent, referrer, and access to hosts routable only from the viewer's network. Chrome and WebKit do not fetch these references, and the impact is a network request rather than script execution. The rails-html-sanitizer PermitScrubber reuses the affected safelist when SVG elements are permitted. This issue is fixed in version 2.25.3.
- Record
CVE-2026-126208- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-178, CWE-184
- Updated
- 2026-11-12
OSV
Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG_ALLOW_LOCAL_HREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external href and xlink:href values on those elements survive sanitization. Firefox fetches the attacker-chosen URL when a viewer renders the content, which can disclose the viewer's IP address, user agent, referrer, and access to hosts routable only from the viewer's network. Chrome and WebKit do not fetch these references, and the impact is a network request rather than script execution. The rails-html-sanitizer PermitScrubber reuses the affected safelist when SVG elements are permitted. This issue is fixed in version 2.25.3.
- Record
CVE-2026-126208- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-178, CWE-184
- Updated
- 2026-11-14
OSVGHSA-345x-3rq2-jfrm
Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction
Summary
Loofah restricts href and xlink:href on certain SVG elements to same-document references. Two elements escaped the restriction:
<textPath>:SVG_ALLOW_LOCAL_HREFlisted it in lowercase astextpath, but the HTML5 parser names the elementtextPathinside<svg>, so the check never matched on the HTML5 path.<mpath>: absent fromSVG_ALLOW_LOCAL_HREF, so its references were never restricted on either path.
rails-html-sanitizer reuses this safelist in its PermitScrubber, so it is affected too.
Impact
An external href or xlink:href on <textPath> or <mpath> survives sanitization. Firefox fetches the URL when rendering the content, which leaks the viewer's IP address, user agent, and referrer, and can reach hosts routable only from the viewer's network. Chrome and WebKit do not fetch external references on these elements. The impact is a network request to an attacker-chosen URL, not script execution.
Applications that sanitize user-supplied SVG, directly or inside HTML, with Loofah's default allowlist or with rails-html-sanitizer with SVG elements permitted are affected.
Mitigation
Upgrade to Loofah >= 2.25.3.
- Record
GHSA-345x-3rq2-jfrm- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-178, CWE-184
- Updated
- 2026-11-12
OSVUBUNTU-CVE-2026-126208
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG_ALLOW_LOCAL_HREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external href and xlink:href values on those elements survive sanitization. Firefox fetches the attacker-chosen URL when a viewer renders the content, which can disclose the viewer's IP address, user agent, referrer, and access to hosts routable only from the viewer's network. Chrome and WebKit do not fetch these references, and the impact is a network request rather than script execution. The rails-html-sanitizer PermitScrubber reuses the affected safelist when SVG elements are permitted. This issue is fixed in version 2.25.3.
- Record
UBUNTU-CVE-2026-126208- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Updated
- 2026-11-13
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| references | OSV | |
| published | EUVD, NVD | |
| aliases | EUVD | |
| affected, references | OSV | |
| description, products, published, references, severity | CVE List | |
| first indexed | GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/flavorjones/loofah/security/advisories/GHSA-345x-3rq2-jfrm
Left out here: 15 versions. The JSON record has them.