CVE-2026-73492: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in flavorjones loofah
CVE-2026-73492 is a low-severity cross-site scripting (XSS) vulnerability in the flavorjones loofah library versions 2.25.0 through 2.25.1. The flaw occurs in the Loofah::HTML5::Scrub.allowed_uri? method, which fails to reject javascript: or vbscript: URIs when their scheme is obfuscated using semicolon-less numeric character references. This can cause unsafe URLs to be incorrectly marked as safe, potentially leading to XSS if callers pass HTML-encoded strings directly to allowed_uri?. The default sanitize() method is not affected. The issue is fixed in version 2.25.2.
AI Analysis
Technical Summary
Loofah is an HTML/XML manipulation library built on Nokogiri. Versions 2.25.0 and 2.25.1 contain a vulnerability in the allowed_uri? method where javascript: or vbscript: URI schemes can be obfuscated using numeric character references without semicolons (e.g., :, 	, 
, 
). Because CGI.unescapeHTML does not decode these references, allowed_uri? incorrectly treats such URIs as safe. This vulnerability only affects callers that pass HTML-encoded strings directly to allowed_uri?; the default sanitize() path is not vulnerable. The flaw is resolved in version 2.25.2.
Potential Impact
The vulnerability could allow an attacker to bypass URI scheme filtering in allowed_uri?, potentially enabling cross-site scripting attacks if the affected method is used improperly with HTML-encoded input. However, the default sanitize() method is not affected, limiting exposure. The CVSS 4.0 base score is 2.3, indicating low severity. There are no known exploits in the wild.
Mitigation Recommendations
Upgrade to loofah version 2.25.2 or later, where this issue is fixed. If upgrading is not immediately possible, avoid passing HTML-encoded strings directly to Loofah::HTML5::Scrub.allowed_uri?. The default sanitize() method remains safe and can be used as a mitigation.
CVE-2026-73492: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in flavorjones loofah
Description
CVE-2026-73492 is a low-severity cross-site scripting (XSS) vulnerability in the flavorjones loofah library versions 2.25.0 through 2.25.1. The flaw occurs in the Loofah::HTML5::Scrub.allowed_uri? method, which fails to reject javascript: or vbscript: URIs when their scheme is obfuscated using semicolon-less numeric character references. This can cause unsafe URLs to be incorrectly marked as safe, potentially leading to XSS if callers pass HTML-encoded strings directly to allowed_uri?. The default sanitize() method is not affected. The issue is fixed in version 2.25.2.
CVSS v4.0
Score 2.3low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Loofah is an HTML/XML manipulation library built on Nokogiri. Versions 2.25.0 and 2.25.1 contain a vulnerability in the allowed_uri? method where javascript: or vbscript: URI schemes can be obfuscated using numeric character references without semicolons (e.g., :, 	, 
, 
). Because CGI.unescapeHTML does not decode these references, allowed_uri? incorrectly treats such URIs as safe. This vulnerability only affects callers that pass HTML-encoded strings directly to allowed_uri?; the default sanitize() path is not vulnerable. The flaw is resolved in version 2.25.2.
Potential Impact
The vulnerability could allow an attacker to bypass URI scheme filtering in allowed_uri?, potentially enabling cross-site scripting attacks if the affected method is used improperly with HTML-encoded input. However, the default sanitize() method is not affected, limiting exposure. The CVSS 4.0 base score is 2.3, indicating low severity. There are no known exploits in the wild.
Mitigation Recommendations
Upgrade to loofah version 2.25.2 or later, where this issue is fixed. If upgrading is not immediately possible, avoid passing HTML-encoded strings directly to Loofah::HTML5::Scrub.allowed_uri?. The default sanitize() method remains safe and can be used as a mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-12T19:00:33.735Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7ce514bf8831d5392fb5db
Added to database: 08/12/2026, 21:26:44 UTC
Last enriched: 08/12/2026, 21:42:19 UTC
Last updated: 08/13/2026, 02:13:12 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.