{"id":"GHSA-h6v6-rg66-fqj4","summary":"Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values","details":"## Summary\n\nLoofah's HTML5 scrubbers could emit output that a browser parses into different markup, allowing mutation XSS. Nokogiri \u003c 1.19.5 did not escape `\u003c` and `\u003e` in attribute values. When the output contained certain MathML, a browser treated markup inside an allowed attribute as live HTML. The `:strip` scrubber is affected in every browser. The `:prune` and `:escape` scrubbers are affected in WebKit browsers such as Safari.\n\nNokogiri 1.19.5 escapes `\u003c` and `\u003e` in attribute values, as the HTML standard requires. Loofah 2.25.3 requires Nokogiri \u003e= 1.19.5.\n\n## Impact\n\nApplications that sanitize untrusted HTML with Loofah's HTML5 API (`Loofah.html5_fragment`, `Loofah.html5_document` and the `scrub_html5_*` methods) and display the result to other people are affected, including with the default allowlist.\n\nNot affected: Loofah's HTML4 API (including `Loofah::Helpers.sanitize`), the `:whitewash` scrubber, rails-html-sanitizer's default configuration, and JRuby.\n\n## Mitigation\n\nUpgrade to Loofah \u003e= 2.25.3, or upgrade Nokogiri to \u003e= 1.19.5.","aliases":["CVE-2026-126203"],"modified":"2026-11-12T21:00:03.784161248Z","published":"2026-11-12T20:52:09Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-11-12T20:52:09Z","nvd_published_at":null,"cwe_ids":["CWE-116","CWE-79"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-h6v6-rg66-fqj4"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/pull/324"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/pull/3741"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/commit/7ba1e7b77e043fb7dc832ef746fcbf83137135e6"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/commit/635abc8d65c75d594ddf8957fbfbfd822c2c0dbd"},{"type":"PACKAGE","url":"https://github.com/flavorjones/loofah"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/GHSA-h6v6-rg66-fqj4.yml"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"}],"affected":[{"package":{"name":"loofah","ecosystem":"RubyGems","purl":"pkg:gem/loofah"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.0"},{"fixed":"2.25.3"}]}],"versions":["2.21.0","2.21.1","2.21.2","2.21.3","2.21.4","2.22.0","2.23.0","2.23.1","2.24.0","2.24.1","2.25.0","2.25.1","2.25.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-h6v6-rg66-fqj4/GHSA-h6v6-rg66-fqj4.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}