{"id":"CVE-2026-126206","summary":"Loofah allowed_uri? treats data:text/html as safe text/plain","details":"Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.allowed_uri? treats a data URI mediatype containing the HTML5 named solidus reference / as malformed and falls back to the allowed text/plain, while a browser decodes the reference and interprets the same value as text/html. An application that validates a user-controlled URL with this helper and renders the approved value in href or another browser-interpreted URI attribute can allow cross-site scripting. Rails::HTML::Sanitizer.allowed_uri? re-exports the affected helper. Loofah's default sanitize() path is not affected because Nokogiri decodes the entity before URI validation. This issue is fixed in version 2.25.3.","aliases":["GHSA-jcff-cj73-4w4f"],"modified":"2026-11-13T10:46:20.182391637Z","published":"2026-11-12T20:51:36.537Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-184","CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126206.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126206.json"},{"type":"FIX","url":"https://github.com/flavorjones/loofah/commit/ad92002966053309f83b550861e2ef04bc714744"},{"type":"FIX","url":"https://github.com/flavorjones/loofah/pull/324"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"},{"type":"ADVISORY","url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-jcff-cj73-4w4f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126206"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/flavorjones/loofah","events":[{"introduced":"2706d7e858426ba856d9711b0e761b2fee7986c4"},{"last_affected":"2706d7e858426ba856d9711b0e761b2fee7986c4"},{"fixed":"ad92002966053309f83b550861e2ef04bc714744"},{"fixed":"bbe007e52e8aeaa520b3e515235d467f5b1416e6"}],"database_specific":{"extracted_events":[{"strategy":"StandaloneSingleVersion","range":[{"introduced":"= 2.25.2"},{"last_affected":"= 2.25.2"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"ad92002966053309f83b550861e2ef04bc714744"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"v2.25.3","range":[{"fixed":"bbe007e52e8aeaa520b3e515235d467f5b1416e6"}]}]}}],"versions":["= 2.25.2","v2.25.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126206.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}