CVE-2026-126203

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-126203
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126203.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-126203
Aliases
Downstream
CGA (9)
Published
2026-11-12T18:06:34Z
Modified
2026-11-13T10:45:54Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values
Details

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5_fragment, Loofah.html5_document, and the scrub_html5_* methods can emit sanitized output that a browser reparses as different markup when used with Nokogiri before 1.19.5, because those Nokogiri versions do not escape angle brackets in attribute values. MathML can place markup inside an allowed attribute so the reparsed output becomes live HTML. The :strip scrubber is affected in every browser, while :prune and :escape are affected in WebKit browsers. Loofah's HTML4 APIs, Loofah::Helpers.sanitize, :whitewash, rails-html-sanitizer's default configuration, and JRuby are not affected. This issue is fixed in version 2.25.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-116",
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126203.json"
}
References

Affected packages

Git / github.com/flavorjones/loofah

Affected ranges

Type
GIT
Repo
https://github.com/flavorjones/loofah
Events
Introduced
a9b51f497bade7747d78546fcae4cf3219317c8c
Fixed
bbe007e52e8aeaa520b3e515235d467f5b1416e6
Fixed
7ba1e7b77e043fb7dc832ef746fcbf83137135e6
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.21.0"
                },
                {
                    "fixed": "2.25.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "7ba1e7b77e043fb7dc832ef746fcbf83137135e6"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v2.25.3",
            "range": [
                {
                    "fixed": "bbe007e52e8aeaa520b3e515235d467f5b1416e6"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v2.*
v2.21.0
v2.21.1
v2.21.2
v2.21.3
v2.21.4
v2.22.0
v2.23.0
v2.23.1
v2.24.0
v2.24.1
v2.25.0
v2.25.1
v2.25.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126203.json"