{"id":"CVE-2026-126208","aliases":["EUVD-2026-124715","GHSA-345x-3rq2-jfrm","UBUNTU-CVE-2026-126208"],"status":"published","title":"Loofah: SVG `\u003ctextPath\u003e` and `\u003cmpath\u003e` bypass local-reference restriction","description":"Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG_ALLOW_LOCAL_HREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external href and xlink:href values on those elements survive sanitization. Firefox fetches the attacker-chosen URL when a viewer renders the content, which can disclose the viewer's IP address, user agent, referrer, and access to hosts routable only from the viewer's network. Chrome and WebKit do not fetch these references, and the impact is a network request rather than script execution. The rails-html-sanitizer PermitScrubber reuses the affected safelist when SVG elements are permitted. This issue is fixed in version 2.25.3.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-13","score":0.00365,"percentile":0.30746,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-178","CWE-184"],"published":"2026-11-12T20:59:48Z","modified":"2026-11-13T21:05:52Z","fixes":[{"ecosystem":"RubyGems","package":"loofah","fixed_in":["2.25.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"loofah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.3"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"loofah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.3"}]}],"versions":["0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","1.0.0","1.0.0.beta.1","1.1.0","1.2.0","1.2.1","2.0.0","2.0.1","2.0.2","2.0.3","2.1.0","2.1.0.rc1","2.1.0.rc2","2.1.1","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.15.0","2.16.0","2.17.0","2.18.0","2.19.0","2.19.1","2.2.0","2.2.1","2.2.2","2.2.3","2.20.0","2.21.0","2.21.0.rc1","2.21.1","2.21.2","2.21.3","2.21.4","2.22.0","2.23.0","2.23.1","2.24.0","2.24.1","2.25.0","2.25.1","2.25.2","2.3.0","2.3.1","2.4.0","2.5.0","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-loofah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.2-1","2.0.3-1","2.0.3-2","2.0.3-2+deb9u1build0.16.04.1","2.0.3-2+deb9u2build0.16.04.1","2.0.3-2+deb9u3build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruby-loofah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.3-2","2.2.2-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby-loofah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.3-1","2.3.1+dfsg-1","2.4.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-loofah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.0-1","2.13.0-1","2.13.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby-loofah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.21.3-1","2.21.4-1","2.22.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ruby-loofah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.25.0-1","2.25.1-2","2.25.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ruby-loofah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.24.1-1","2.25.0-1"]}],"products":[{"vendor":"flavorjones","product":"loofah"}],"references":[{"url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-345x-3rq2-jfrm","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/flavorjones/loofah/pull/324","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/flavorjones/loofah/commit/cdd6ff7fb51998eb181bd2da925ddbcfcc8a3b96","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3","tags":["x_refsource_MISC","web","report"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/GHSA-345x-3rq2-jfrm.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-345x-3rq2-jfrm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126208.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126208","tags":["advisory"]},{"url":"https://github.com/flavorjones/loofah","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-126208","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-126208","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-126208","title":"Loofah: SVG `\u003ctextPath\u003e` and `\u003cmpath\u003e` bypass local-reference restriction","description":"Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG_ALLOW_LOCAL_HREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external href and xlink:href values on those elements survive sanitization. Firefox fetches the attacker-chosen URL when a viewer renders the content, which can disclose the viewer's IP address, user agent, referrer, and access to hosts routable only from the viewer's network. Chrome and WebKit do not fetch these references, and the impact is a network request rather than script execution. The rails-html-sanitizer PermitScrubber reuses the affected safelist when SVG elements are permitted. This issue is fixed in version 2.25.3.","status":"published","published":"2026-11-12T20:59:48.651Z","modified":"2026-11-13T00:32:25.406Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-178","CWE-184"],"updated_at":"2026-11-12T21:48:41.197491Z"}],"euvd":[{"id":"EUVD-2026-124715","description":"Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG_ALLOW_LOCAL_HREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external href and xlink:href values on those elements survive sanitization. Firefox fetches the attacker-chosen URL when a viewer renders the content, which can disclose the viewer's IP address, user agent, referrer, and access to hosts routable only from the viewer's network. Chrome and WebKit do not fetch these references, and the impact is a network request rather than script execution. The rails-html-sanitizer PermitScrubber reuses the affected safelist when SVG elements are permitted. This issue is fixed in version 2.25.3.","status":"published","published":"2026-11-12T20:59:48Z","modified":"2026-11-13T00:32:25Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-12T23:36:13.328131Z"}],"ghsa":[{"id":"GHSA-345x-3rq2-jfrm","title":"Loofah: SVG `\u003ctextPath\u003e` and `\u003cmpath\u003e` bypass local-reference restriction","description":"## Summary\n\nLoofah restricts `href` and `xlink:href` on certain SVG elements to same-document references. Two elements escaped the restriction:\n\n- `\u003ctextPath\u003e`: `SVG_ALLOW_LOCAL_HREF` listed it in lowercase as `textpath`, but the HTML5 parser names the element `textPath` inside `\u003csvg\u003e`, so the check never matched on the HTML5 path.\n- `\u003cmpath\u003e`: absent from `SVG_ALLOW_LOCAL_HREF`, so its references were never restricted on either path.\n\n`rails-html-sanitizer` reuses this safelist in its `PermitScrubber`, so it is affected too.\n\n## Impact\n\nAn external `href` or `xlink:href` on `\u003ctextPath\u003e` or `\u003cmpath\u003e` survives sanitization. Firefox fetches the URL when rendering the content, which leaks the viewer's IP address, user agent, and referrer, and can reach hosts routable only from the viewer's network. Chrome and WebKit do not fetch external references on these elements. The impact is a network request to an attacker-chosen URL, not script execution.\n\nApplications that sanitize user-supplied SVG, directly or inside HTML, with Loofah's default allowlist or with `rails-html-sanitizer` with SVG elements permitted are affected.\n\n## Mitigation\n\nUpgrade to Loofah \u003e= 2.25.3.","status":"published","published":"2026-11-12T21:26:53Z","modified":"2026-11-12T21:27:48Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-178","CWE-184"],"updated_at":"2026-11-12T21:43:33.07162Z"}],"nvd":[{"id":"CVE-2026-126208","description":"Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG_ALLOW_LOCAL_HREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external href and xlink:href values on those elements survive sanitization. Firefox fetches the attacker-chosen URL when a viewer renders the content, which can disclose the viewer's IP address, user agent, referrer, and access to hosts routable only from the viewer's network. Chrome and WebKit do not fetch these references, and the impact is a network request rather than script execution. The rails-html-sanitizer PermitScrubber reuses the affected safelist when SVG elements are permitted. This issue is fixed in version 2.25.3.","status":"published","published":"2026-11-12T21:17:22.023Z","modified":"2026-11-13T02:18:51.653Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-178","CWE-184"],"updated_at":"2026-11-12T23:33:09.696019Z"}],"osv":[{"id":"CVE-2026-126208","title":"Loofah: SVG `\u003ctextPath\u003e` and `\u003cmpath\u003e` bypass local-reference restriction","description":"Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG_ALLOW_LOCAL_HREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external href and xlink:href values on those elements survive sanitization. Firefox fetches the attacker-chosen URL when a viewer renders the content, which can disclose the viewer's IP address, user agent, referrer, and access to hosts routable only from the viewer's network. Chrome and WebKit do not fetch these references, and the impact is a network request rather than script execution. The rails-html-sanitizer PermitScrubber reuses the affected safelist when SVG elements are permitted. This issue is fixed in version 2.25.3.","status":"published","published":"2026-11-12T20:59:48.651Z","modified":"2026-11-14T02:47:26.93021663Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-178","CWE-184"],"updated_at":"2026-11-14T03:11:13.096066Z"},{"id":"GHSA-345x-3rq2-jfrm","title":"Loofah: SVG `\u003ctextPath\u003e` and `\u003cmpath\u003e` bypass local-reference restriction","description":"## Summary\n\nLoofah restricts `href` and `xlink:href` on certain SVG elements to same-document references. Two elements escaped the restriction:\n\n- `\u003ctextPath\u003e`: `SVG_ALLOW_LOCAL_HREF` listed it in lowercase as `textpath`, but the HTML5 parser names the element `textPath` inside `\u003csvg\u003e`, so the check never matched on the HTML5 path.\n- `\u003cmpath\u003e`: absent from `SVG_ALLOW_LOCAL_HREF`, so its references were never restricted on either path.\n\n`rails-html-sanitizer` reuses this safelist in its `PermitScrubber`, so it is affected too.\n\n## Impact\n\nAn external `href` or `xlink:href` on `\u003ctextPath\u003e` or `\u003cmpath\u003e` survives sanitization. Firefox fetches the URL when rendering the content, which leaks the viewer's IP address, user agent, and referrer, and can reach hosts routable only from the viewer's network. Chrome and WebKit do not fetch external references on these elements. The impact is a network request to an attacker-chosen URL, not script execution.\n\nApplications that sanitize user-supplied SVG, directly or inside HTML, with Loofah's default allowlist or with `rails-html-sanitizer` with SVG elements permitted are affected.\n\n## Mitigation\n\nUpgrade to Loofah \u003e= 2.25.3.","status":"published","published":"2026-11-12T21:26:53Z","modified":"2026-11-12T21:45:03.445343054Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-178","CWE-184"],"updated_at":"2026-11-12T22:16:36.592232Z"},{"id":"UBUNTU-CVE-2026-126208","description":"Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG_ALLOW_LOCAL_HREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external href and xlink:href values on those elements survive sanitization. Firefox fetches the attacker-chosen URL when a viewer renders the content, which can disclose the viewer's IP address, user agent, referrer, and access to hosts routable only from the viewer's network. Chrome and WebKit do not fetch these references, and the impact is a network request rather than script execution. The rails-html-sanitizer PermitScrubber reuses the affected safelist when SVG elements are permitted. This issue is fixed in version 2.25.3.","status":"published","published":"2026-11-13T00:00:00Z","modified":"2026-11-13T21:05:52.019153621Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-13T21:30:20.292037Z"}]}}