Every CVE Search/ Get API key

CVE-2026-73492

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

2.3 LowFix available

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as &#58, &#9, &#10, or &#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.39%Up 0.1 points since Aug 13, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.3

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as &#58, &#9, &#10, or &#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

Record
CVE-2026-73492
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79, CWE-184
Updated
2026-11-02
EUVDEUVD-2026-57629 2.3

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as &#58, &#9, &#10, or &#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

Record
EUVD-2026-57629
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-5qhf-9phg-95m2 2.3

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Summary

Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript: or vbscript: URIs when the scheme is split by a numeric character reference that has no trailing semicolon. A browser decodes such references and resolves the URL to an executable javascript: scheme, while allowed_uri? reports it safe.

This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled numeric character references with a trailing ; (	, 
, 
) but did not cover the forms without semicolons.

Details

allowed_uri? decodes HTML entities with CGI.unescapeHTML, which decodes numeric character references only when they carry a trailing ;. A reference without a semicolon such as &#58 (colon) or &#9 (tab) is left literal, so the scheme-detection check finds no scheme, and the method falls through to its scheme-less path and returns true.

A browser, however, decodes numeric character references even without a trailing semicolon. An encoded colon such as &#58 becomes the : scheme separator, so javascript&#58alert(1) resolves to javascript:alert(1). Encoded whitespace such as &#9 (tab) is decoded and then stripped from the URL, rejoining the surrounding text, so java&#9script:alert(1) also resolves to javascript:alert(1). In both cases the URL executes while allowed_uri? approved it as safe.

Note that Loofah's default sanitize() path is not affected, because Nokogiri decodes or entity-escapes HTML entities during parsing before Loofah evaluates the URI protocol. This issue only affects callers of the public allowed_uri? string-level helper that pass it HTML-encoded strings.

Impact

Callers that validate a user-controlled URL with Loofah::HTML5::Scrub.allowed_uri? and then render the approved value into an href or other browser-interpreted URI attribute may be vulnerable to cross-site scripting (XSS). This includes applications that call allowed_uri? directly, as well as higher-level features built on top of it, such as Action Text 8.2's markdown link validation.

Mitigation

Upgrade to Loofah >= 2.25.2.

Credit

Responsibly reported by GitHub user @MoonFuji.

Record
GHSA-5qhf-9phg-95m2
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79, CWE-184
Updated
2026-11-02
NVD 2.3

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as &#58, &#9, &#10, or &#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

Record
CVE-2026-73492
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-79, CWE-184
Updated
2026-11-02
OSV 2.3

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as &#58, &#9, &#10, or &#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

Record
CVE-2026-73492
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-184, CWE-79
Updated
2026-11-02
OSVDEBIAN-CVE-2026-73492 2.3

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as &#58, &#9, &#10, or &#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

Record
DEBIAN-CVE-2026-73492
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-5qhf-9phg-95m2 2.3

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Summary

Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript: or vbscript: URIs when the scheme is split by a numeric character reference that has no trailing semicolon. A browser decodes such references and resolves the URL to an executable javascript: scheme, while allowed_uri? reports it safe.

This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled numeric character references with a trailing ; (	, 
, 
) but did not cover the forms without semicolons.

Details

allowed_uri? decodes HTML entities with CGI.unescapeHTML, which decodes numeric character references only when they carry a trailing ;. A reference without a semicolon such as &#58 (colon) or &#9 (tab) is left literal, so the scheme-detection check finds no scheme, and the method falls through to its scheme-less path and returns true.

A browser, however, decodes numeric character references even without a trailing semicolon. An encoded colon such as &#58 becomes the : scheme separator, so javascript&#58alert(1) resolves to javascript:alert(1). Encoded whitespace such as &#9 (tab) is decoded and then stripped from the URL, rejoining the surrounding text, so java&#9script:alert(1) also resolves to javascript:alert(1). In both cases the URL executes while allowed_uri? approved it as safe.

Note that Loofah's default sanitize() path is not affected, because Nokogiri decodes or entity-escapes HTML entities during parsing before Loofah evaluates the URI protocol. This issue only affects callers of the public allowed_uri? string-level helper that pass it HTML-encoded strings.

Impact

Callers that validate a user-controlled URL with Loofah::HTML5::Scrub.allowed_uri? and then render the approved value into an href or other browser-interpreted URI attribute may be vulnerable to cross-site scripting (XSS). This includes applications that call allowed_uri? directly, as well as higher-level features built on top of it, such as Action Text 8.2's markdown link validation.

Mitigation

Upgrade to Loofah >= 2.25.2.

Credit

Responsibly reported by GitHub user @MoonFuji.

Record
GHSA-5qhf-9phg-95m2
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-184, CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2026-73492 2.3

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as &#58, &#9, &#10, or &#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

Record
UBUNTU-CVE-2026-73492
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:12153-1 No score

hawk2-2.7.2+git.1792148770.648dcddb-1.1 on GA media

These are all security issues fixed in the hawk2-2.7.2+git.1792148770.648dcddb-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12153-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22068-1 No score

Security update for hawk2

This update for hawk2 fixes the following issues:

  • CVE-2026-42246: net-imap: MITM attacker can cause Net::IMAP#starttls to return successfully, without starting TLS (bsc#1268996).
  • CVE-2026-66066: unsafe image processing operations on untrusted uploads can allow arbitrary file reading and remote code execution (bsc#1273348).
  • CVE-2026-71847: json: heap use-after free in JSON::ResumableParser partial_value can lead to crash on truncated duplicate-key streams (bsc#1275213).
  • CVE-2026-73490: loofah: improper handling of SVG attributes in the HTML5 sanitizer allows bypass of local-reference restrictions (bsc#1275179).
  • CVE-2026-73491: loofah: improper handling of javascript: URIs can lead to XSS (bsc#1275183).
  • CVE-2026-73492: loofah: improper handling of javascript: and vbscript: URIs can lead to XSS (bsc#1275188).
  • CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when the sanitizer is configured to allow certain SVG reference elements (bsc#1275200).

Changes for hawk2:

  • Update to version 2.7.2+git.1788518533.7d4dadd6 (bsc#1275019):
  • Test: give sle15 more time when choosing between sle15 and sle16
  • Dev: bump jQuery version to 4.0.0
  • Dev: bump jQuery version to 3.5.0
  • Dev: bump jQuery version to 2.2.4
  • Test: update the e2e test for the change allowing custom parameters
  • Dev: enable custom Parameters and Meta Attributes (bsc#1274860)
  • CI/CD: update hawk examiner entry point
  • Test: enable test_add_clone against hawk-apiserver verion 0.2.1
  • Test: fix SyntaxWarning: invalid escape sequence '|'
  • Test: make the tests compatible against hawk-apiserver ver0.2.0
Record
openSUSE-SU-2026:22068-1
Updated
2026-11-02
OSVSUSE-SU-2026:24195-1 No score

Security update for hawk2

This update for hawk2 fixes the following issues:

  • CVE-2026-42246: net-imap: MITM attacker can cause Net::IMAP#starttls to return successfully, without starting TLS (bsc#1268996).
  • CVE-2026-66066: unsafe image processing operations on untrusted uploads can allow arbitrary file reading and remote code execution (bsc#1273348).
  • CVE-2026-71847: json: heap use-after free in JSON::ResumableParser partial_value can lead to crash on truncated duplicate-key streams (bsc#1275213).
  • CVE-2026-73490: loofah: improper handling of SVG attributes in the HTML5 sanitizer allows bypass of local-reference restrictions (bsc#1275179).
  • CVE-2026-73491: loofah: improper handling of javascript: URIs can lead to XSS (bsc#1275183).
  • CVE-2026-73492: loofah: improper handling of javascript: and vbscript: URIs can lead to XSS (bsc#1275188).
  • CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when the sanitizer is configured to allow certain SVG reference elements (bsc#1275200).

Changes for hawk2:

  • Update to version 2.7.2+git.1788518533.7d4dadd6 (bsc#1275019):
  • Test: give sle15 more time when choosing between sle15 and sle16
  • Dev: bump jQuery version to 4.0.0
  • Dev: bump jQuery version to 3.5.0
  • Dev: bump jQuery version to 2.2.4
  • Test: update the e2e test for the change allowing custom parameters
  • Dev: enable custom Parameters and Meta Attributes (bsc#1274860)
  • CI/CD: update hawk examiner entry point
  • Test: enable test_add_clone against hawk-apiserver verion 0.2.1
  • Test: fix SyntaxWarning: invalid escape sequence '|'
  • Test: make the tests compatible against hawk-apiserver ver0.2.0
Record
SUSE-SU-2026:24195-1
Updated
2026-11-02
OSVSUSE-SU-2026:24250-1 No score

Security update for hawk2

This update for hawk2 fixes the following issues:

  • CVE-2026-42246: net-imap: MITM attacker can cause Net::IMAP#starttls to return successfully, without starting TLS (bsc#1268996).
  • CVE-2026-66066: unsafe image processing operations on untrusted uploads can allow arbitrary file reading and remote code execution (bsc#1273348).
  • CVE-2026-71847: json: heap use-after free in JSON::ResumableParser partial_value can lead to crash on truncated duplicate-key streams (bsc#1275213).
  • CVE-2026-73490: loofah: improper handling of SVG attributes in the HTML5 sanitizer allows bypass of local-reference restrictions (bsc#1275179).
  • CVE-2026-73491: loofah: improper handling of javascript: URIs can lead to XSS (bsc#1275183).
  • CVE-2026-73492: loofah: improper handling of javascript: and vbscript: URIs can lead to XSS (bsc#1275188).
  • CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when the sanitizer is configured to allow certain SVG reference elements (bsc#1275200).

Changes for hawk2:

  • Update to version 2.7.2+git.1788518533.7d4dadd6 (bsc#1275019):
  • Test: give sle15 more time when choosing between sle15 and sle16
  • Dev: bump jQuery version to 4.0.0
  • Dev: bump jQuery version to 3.5.0
  • Dev: bump jQuery version to 2.2.4
  • Test: update the e2e test for the change allowing custom parameters
  • Dev: enable custom Parameters and Meta Attributes (bsc#1274860)
  • CI/CD: update hawk examiner entry point
  • Test: enable test_add_clone against hawk-apiserver verion 0.2.1
  • Test: fix SyntaxWarning: invalid escape sequence '|'
  • Test: make the tests compatible against hawk-apiserver ver0.2.0
Record
SUSE-SU-2026:24250-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
loofah
RubyGems
 2.25.0 up to 2.25.2
2.25.2
ruby-loofah
Debian:12
 All versions, plus listed versions
2.19.1-12.20.0-12.21.3-12.21.4-12.22.0-1
Show 6 moreShow less
2.24.0-12.24.1-12.25.0-12.25.1-12.25.1-22.25.2-1
 None known
ruby-loofah
Debian:13
 All versions, plus listed versions
2.24.0-12.24.1-12.25.0-12.25.1-12.25.1-22.25.2-1
 None known
ruby-loofah
Debian:14
 before 2.25.2-1, plus listed versions
2.24.0-12.24.1-12.25.0-12.25.1-12.25.1-2
2.25.2-1
loofah
RubyGems
 2.25.0 up to 2.25.2, plus listed versions
2.25.1
2.25.2
hawk2
SUSE:Linux Enterprise High Availability Extension 16.0
From an advisory covering 7 CVEs
 before 2.7.2+git.1788518533.7d4dadd6-160000.1.1
2.7.2+git.1788518533.7d4dadd6-160000.1.1
hawk2
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 7 CVEs
 before 2.7.2+git.1788518533.7d4dadd6-160000.1.1
2.7.2+git.1788518533.7d4dadd6-160000.1.1
ruby-loofah
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.0.2-12.0.3-12.0.3-22.0.3-2+deb9u1build0.16.04.12.0.3-2+deb9u2build0.16.04.12.0.3-2+deb9u3build0.16.04.1
 None known
ruby-loofah
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.0.3-22.2.2-1
 None known
ruby-loofah
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.2.3-12.3.1+dfsg-12.4.0+dfsg-1
 None known
Show 6 moreShow less
Affected packages
PackageAffectedFixed
ruby-loofah
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.12.0-12.13.0-12.13.0-2
 None known
ruby-loofah
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.21.3-12.21.4-12.22.0-1
 None known
ruby-loofah
Ubuntu:26.10
 All versions, plus listed versions
2.25.0-12.25.1-22.25.2-1
 None known
ruby-loofah
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.24.1-12.25.0-1
 None known
hawk2
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 2.7.2+git.1792148770.648dcddb-1.1
2.7.2+git.1792148770.648dcddb-1.1
hawk2
openSUSE:Leap 16.0
From an advisory covering 7 CVEs
 before 2.7.2+git.1788518533.7d4dadd6-160000.1.1
2.7.2+git.1788518533.7d4dadd6-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-73492 is a low vulnerability (CVSS 2.3) in Flavorjones Loofah, published July 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in loofah 2.25.2.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open