CVE-2026-126206

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126206", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-11-10T20:07:44.958Z", "datePublished": "2026-11-12T20:51:36.537Z", "dateUpdated": "2026-11-12T20:51:36.537Z"}, "containers": {"cna": {"title": "Loofah allowed_uri? treats data:text/html as safe text/plain", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-184", "lang": "en", "description": "CWE-184: Incomplete List of Disallowed Inputs", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/flavorjones/loofah/security/advisories/GHSA-jcff-cj73-4w4f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/flavorjones/loofah/security/advisories/GHSA-jcff-cj73-4w4f"}, {"name": "https://github.com/flavorjones/loofah/pull/324", "tags": ["x_refsource_MISC"], "url": "https://github.com/flavorjones/loofah/pull/324"}, {"name": "https://github.com/flavorjones/loofah/commit/ad92002966053309f83b550861e2ef04bc714744", "tags": ["x_refsource_MISC"], "url": "https://github.com/flavorjones/loofah/commit/ad92002966053309f83b550861e2ef04bc714744"}, {"name": "https://github.com/flavorjones/loofah/releases/tag/v2.25.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/flavorjones/loofah/releases/tag/v2.25.3"}], "affected": [{"vendor": "flavorjones", "product": "loofah", "versions": [{"version": "= 2.25.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-12T20:51:36.537Z"}, "descriptions": [{"lang": "en", "value": "Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.allowed_uri? treats a data URI mediatype containing the HTML5 named solidus reference / as malformed and falls back to the allowed text/plain, while a browser decodes the reference and interprets the same value as text/html. An application that validates a user-controlled URL with this helper and renders the approved value in href or another browser-interpreted URI attribute can allow cross-site scripting. Rails::HTML::Sanitizer.allowed_uri? re-exports the affected helper. Loofah's default sanitize() path is not affected because Nokogiri decodes the entity before URI validation. This issue is fixed in version 2.25.3."}], "source": {"advisory": "GHSA-jcff-cj73-4w4f", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "loofah", "vendor": "flavorjones", "versions": [{"status": "affected", "version": "= 2.25.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.allowed_uri? treats a data URI mediatype containing the HTML5 named solidus reference / as malformed and falls back to the allowed text/plain, while a browser decodes the reference and interprets the same value as text/html. An application that validates a user-controlled URL with this helper and renders the approved value in href or another browser-interpreted URI attribute can allow cross-site scripting. Rails::HTML::Sanitizer.allowed_uri? re-exports the affected helper. Loofah's default sanitize() path is not affected because Nokogiri decodes the entity before URI validation. This issue is fixed in version 2.25.3."}], "id": "CVE-2026-126206", "lastModified": "2026-11-12T22:09:39.233", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-11-12T21:17:21.670", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/flavorjones/loofah/commit/ad92002966053309f83b550861e2ef04bc714744"}, {"source": "security-advisories@github.com", "url": "https://github.com/flavorjones/loofah/pull/324"}, {"source": "security-advisories@github.com", "url": "https://github.com/flavorjones/loofah/releases/tag/v2.25.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/flavorjones/loofah/security/advisories/GHSA-jcff-cj73-4w4f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-184"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "loofah: Loofah: Cross-site scripting via improper data URI validation", "id": "2572831", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572831"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["A flaw was found in Loofah. This vulnerability allows cross-site scripting (XSS) because the library's address validation helper fails to properly handle HTML character references in data URIs (Uniform Resource Identifiers). As a result, the helper incorrectly treats potentially harmful HTML content as safe plain text. A remote attacker could exploit this by supplying a crafted link that, when validated and rendered in a victim's browser, executes arbitrary script."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-126206", "package_state": [{"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Not affected", "package_name": "3scale-amp2/system-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Not affected", "package_name": "3scale-amp2/system-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Not affected", "package_name": "3scale-amp2/zync-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "rubygem-loofah", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-11-12T20:51:36Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-126206\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-126206\nhttps://github.com/flavorjones/loofah/commit/ad92002966053309f83b550861e2ef04bc714744\nhttps://github.com/flavorjones/loofah/pull/324\nhttps://github.com/flavorjones/loofah/releases/tag/v2.25.3\nhttps://github.com/flavorjones/loofah/security/advisories/GHSA-jcff-cj73-4w4f"], "statement": "This vulnerability is evaluated as Moderate rather than Important because successful exploitation requires user interaction and is restricted to cases where applications explicitly invoke standalone URI validation routines on unparsed input. In typical deployments, standard HTML sanitization workflows decode entities during document parsing prior to URI evaluation, preventing the encoding discrepancy that leads to script injection. The overall attack surface is therefore limited to custom application code that renders isolated, validated links directly into client browsers.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.25.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "loofah", "source": "cna", "vendor": "flavorjones"}, "product": "loofah", "vendor": "flavorjones"}], "created": "2026-11-13T01:00:09.807619+00:00", "updated": "2026-11-13T01:00:09.807636+00:00", "vendors": ["flavorjones", "flavorjones$PRODUCT$loofah"]}