GHSA-m3x9-938q-5767

Suggest an improvement
Source
https://github.com/advisories/GHSA-m3x9-938q-5767
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m3x9-938q-5767/GHSA-m3x9-938q-5767.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-m3x9-938q-5767
Aliases
  • CVE-2026-126207
Published
2026-11-12T21:05:41Z
Modified
2026-11-12T21:15:10Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N CVSS Calculator
Summary
Loofah: CSS url() sanitization bypass via escaped parentheses
Details

Summary

Loofah::HTML5::Scrub.scrub_css rejected any property whose top-level Crass tokens included a :url or :bad_url, and left url out of the allowed CSS functions. Both checks ran only against the first parse of the style attribute. When scrub_css rebuilt each property it emitted identifiers with their CSS escapes decoded, so parentheses written as escapes — url\28 …\29 — hid the url token from the checks, and the rebuilt value was re-parsed into a live url() that nothing checked again. An escaped property name, six-digit escapes, escaped comments and escaped quotes all reached the same place.

Impact

A sanitized style attribute could make a viewer's browser issue a request to an attacker-chosen URL. list-style fetches on render with no interaction, cursor on hover. That leaks the viewer's IP address, user agent and access timing, and can reach hosts routable only from the viewer's network. No script survives sanitization and the attacker cannot read the response, so the request itself is the whole impact.

Applications that sanitize user-supplied HTML with Loofah's default allowlist and display it to other people are affected.

Mitigation

Upgrade to Loofah >= 2.25.3.

Credit

Reported by NotAFlightRisk through GitHub's private vulnerability reporting.

Database specific 
{
    "cwe_ids": [
        "CWE-180",
        "CWE-184"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-12T21:05:41Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}
References

Affected packages

RubyGems / loofah

Package

Name
loofah
Purl
pkg:gem/loofah

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.25.3

Affected versions

0.*
0.2.0
0.2.1
0.2.2
0.3.0
0.3.1
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
1.*
1.0.0.beta.1
1.0.0
1.1.0
1.2.0
1.2.1
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0.rc1
2.1.0.rc2
2.1.0
2.1.1
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0
2.3.1
2.4.0
2.5.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.19.1
2.20.0
2.21.0.rc1
2.21.0
2.21.1
2.21.2
2.21.3
2.21.4
2.22.0
2.23.0
2.23.1
2.24.0
2.24.1
2.25.0
2.25.1
2.25.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m3x9-938q-5767/GHSA-m3x9-938q-5767.json"