GHSA-345x-3rq2-jfrm

Suggest an improvement
Source
https://github.com/advisories/GHSA-345x-3rq2-jfrm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-345x-3rq2-jfrm/GHSA-345x-3rq2-jfrm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-345x-3rq2-jfrm
Aliases
  • CVE-2026-126208
Published
2026-11-12T21:26:53Z
Modified
2026-11-12T21:45:03Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N CVSS Calculator
Summary
Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction
Details

Summary

Loofah restricts href and xlink:href on certain SVG elements to same-document references. Two elements escaped the restriction:

  • <textPath>: SVG_ALLOW_LOCAL_HREF listed it in lowercase as textpath, but the HTML5 parser names the element textPath inside <svg>, so the check never matched on the HTML5 path.
  • <mpath>: absent from SVG_ALLOW_LOCAL_HREF, so its references were never restricted on either path.

rails-html-sanitizer reuses this safelist in its PermitScrubber, so it is affected too.

Impact

An external href or xlink:href on <textPath> or <mpath> survives sanitization. Firefox fetches the URL when rendering the content, which leaks the viewer's IP address, user agent, and referrer, and can reach hosts routable only from the viewer's network. Chrome and WebKit do not fetch external references on these elements. The impact is a network request to an attacker-chosen URL, not script execution.

Applications that sanitize user-supplied SVG, directly or inside HTML, with Loofah's default allowlist or with rails-html-sanitizer with SVG elements permitted are affected.

Mitigation

Upgrade to Loofah >= 2.25.3.

Database specific 
{
    "cwe_ids": [
        "CWE-178",
        "CWE-184"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-12T21:26:53Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}
References

Affected packages

RubyGems / loofah

Package

Name
loofah
Purl
pkg:gem/loofah

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.25.3

Affected versions

0.*
0.2.0
0.2.1
0.2.2
0.3.0
0.3.1
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
1.*
1.0.0.beta.1
1.0.0
1.1.0
1.2.0
1.2.1
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0.rc1
2.1.0.rc2
2.1.0
2.1.1
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0
2.3.1
2.4.0
2.5.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.19.1
2.20.0
2.21.0.rc1
2.21.0
2.21.1
2.21.2
2.21.3
2.21.4
2.22.0
2.23.0
2.23.1
2.24.0
2.24.1
2.25.0
2.25.1
2.25.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-345x-3rq2-jfrm/GHSA-345x-3rq2-jfrm.json"