Skip to contentFlavorjones Loofah vulnerabilities
- flavorjones loofahLoofah allowed_uri? treats javascript: alert(1) as safeCVE-2026-126209Fix available5.3 Medium
- flavorjones loofahLoofah: SVG `<textPath>` and `<mpath>` bypass local-reference restrictionCVE-2026-126208Fix available4.7 Medium
- flavorjones loofahLoofah: CSS url() sanitization bypass via escaped parenthesesCVE-2026-126207Fix available4.7 Medium
- flavorjones loofahLoofah allowed_uri? treats data:text/html as safe text/plainCVE-2026-126206Fix available5.3 Medium
- flavorjones loofahLoofah: Regular expression denial of service in the SVG local-reference checkCVE-2026-126205Fix available5.3 Medium
- flavorjones loofahLoofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute valuesCVE-2026-126203Fix available6.1 Medium
- flavorjones loofahLoofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolonsCVE-2026-73492Fix available2.3 Low
- flavorjones loofahLoofah: SVG `href` attribute bypasses local-reference restrictionCVE-2026-73490Fix available4.7 Medium
- flavorjones loofahLoofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character referencesCVE-2026-73491Fix available2.3 Low
- flavorjones loofahUncontrolled Recursion in LoofahCVE-2022-23516Fix available7.5 High
- flavorjones loofah, debian linux +1 moreImproper neutralization of data URIs may allow XSS in LoofahCVE-2022-23515Fix available6.1 Medium
- flavorjones loofahInefficient Regular Expression Complexity in LoofahCVE-2022-23514Fix available7.5 High