GHSA-h6v6-rg66-fqj4

Source

https://github.com/advisories/GHSA-h6v6-rg66-fqj4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-h6v6-rg66-fqj4/GHSA-h6v6-rg66-fqj4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h6v6-rg66-fqj4

Aliases

CVE-2026-126203

Published

2026-11-12T20:52:09Z

Modified

2026-11-12T21:00:03Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values

Details

Summary

Loofah's HTML5 scrubbers could emit output that a browser parses into different markup, allowing mutation XSS. Nokogiri < 1.19.5 did not escape < and > in attribute values. When the output contained certain MathML, a browser treated markup inside an allowed attribute as live HTML. The :strip scrubber is affected in every browser. The :prune and :escape scrubbers are affected in WebKit browsers such as Safari.

Nokogiri 1.19.5 escapes < and > in attribute values, as the HTML standard requires. Loofah 2.25.3 requires Nokogiri >= 1.19.5.

Impact

Applications that sanitize untrusted HTML with Loofah's HTML5 API (Loofah.html5_fragment, Loofah.html5_document and the scrub_html5_* methods) and display the result to other people are affected, including with the default allowlist.

Not affected: Loofah's HTML4 API (including Loofah::Helpers.sanitize), the :whitewash scrubber, rails-html-sanitizer's default configuration, and JRuby.

Mitigation

Upgrade to Loofah >= 2.25.3, or upgrade Nokogiri to >= 1.19.5.

Database specific

{
    "cwe_ids": [
        "CWE-116",
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-12T20:52:09Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

RubyGems / loofah

Package

Name: loofah
Purl: pkg:gem/loofah

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.21.0

Fixed

2.25.3

Affected versions

2.*

2.21.0

2.21.1

2.21.2

2.21.3

2.21.4

2.22.0

2.23.0

2.23.1

2.24.0

2.24.1

2.25.0

2.25.1

2.25.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-h6v6-rg66-fqj4/GHSA-h6v6-rg66-fqj4.json"