GHSA-9wjq-cp2p-hrgf

Suggest an improvement
Source
https://github.com/advisories/GHSA-9wjq-cp2p-hrgf
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-9wjq-cp2p-hrgf/GHSA-9wjq-cp2p-hrgf.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9wjq-cp2p-hrgf
Aliases
Downstream
CGA (74)
Published
2026-07-21T22:01:58Z
Modified
2026-09-10T03:51:11Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Loofah: SVG `href` attribute bypasses local-reference restriction
Details

Summary

Loofah's HTML5 sanitizer restricted only the xlink:href attribute on certain SVG elements to local, same-document references. Browsers also accept a plain href attribute as an alternative to the deprecated xlink:href per the SVG 2 spec, but Loofah did not apply the same restriction to it, allowing those elements to reference arbitrary external documents.

Impact

SVG <use> can load and render external SVG content by reference. If the referenced external SVG is same-origin and contains scripts or other dangerous content, it could execute in the context of the sanitized document. <feImage> can load external images, which can be used for tracking. Modern browsers restrict cross-origin <use> fetches, which limits but does not eliminate the risk.

Applications that sanitize user-supplied SVG (directly, or as part of HTML) with Loofah's default allowlist are affected.

Mitigation

Upgrade to Loofah >= 2.25.2.

Credit

Found by the maintainer, Mike Dalessio, during a security audit.

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-21T22:01:58Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

RubyGems / loofah

Package

Name
loofah
Purl
pkg:gem/loofah

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.25.2

Affected versions

0.*
0.2.0
0.2.1
0.2.2
0.3.0
0.3.1
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
1.*
1.0.0.beta.1
1.0.0
1.1.0
1.2.0
1.2.1
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0.rc1
2.1.0.rc2
2.1.0
2.1.1
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0
2.3.1
2.4.0
2.5.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.19.1
2.20.0
2.21.0.rc1
2.21.0
2.21.1
2.21.2
2.21.3
2.21.4
2.22.0
2.23.0
2.23.1
2.24.0
2.24.1
2.25.0
2.25.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-9wjq-cp2p-hrgf/GHSA-9wjq-cp2p-hrgf.json"