CVE-2026-126203: Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values
Summary
Loofah's HTML5 scrubbers could emit output that a browser parses into different markup, allowing mutation XSS. Nokogiri < 1.19.5 did not escape < and > in attribute values. When the output contained certain MathML, a browser treated markup inside an allowed attribute as live HTML. The :strip scrubber is affected in every browser. The :prune and :escape scrubbers are affected in WebKit browsers such as Safari.
Nokogiri 1.19.5 escapes < and > in attribute values, as the HTML standard requires. Loofah 2.25.3 requires Nokogiri >= 1.19.5.
Impact
Applications that sanitize untrusted HTML with Loofah's HTML5 API (Loofah.html5fragment, Loofah.html5document and the scrubhtml5 methods) and display the result to other people are affected, including with the default allowlist.
Not affected: Loofah's HTML4 API (including Loofah::Helpers.sanitize), the :whitewash scrubber, rails-html-sanitizer's default configuration, and JRuby.
Mitigation
Upgrade to Loofah >= 2.25.3, or upgrade Nokogiri to >= 1.19.5.
Other sources
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5fragment, Loofah.html5document, and the scrubhtml5 methods can emit sanitized output that a browser reparses as different markup when used with Nokogiri before 1.19.5, because those Nokogiri versions do not escape angle brackets in attribute values. MathML can place markup inside an allowed attribute so the reparsed output becomes live HTML. The :strip scrubber is affected in every browser, while :prune and :escape are affected in WebKit browsers. Loofah's HTML4 APIs, Loofah::Helpers.sanitize, :whitewash, rails-html-sanitizer's default configuration, and JRuby are not affected. This issue is fixed in version 2.25.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/loofahto a version that resolves this vulnerability.Fixed in 2.25.3 - Upgrade
Upgrade
Loofahto a version that resolves this vulnerability.Fixed in 2.25.3 - Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.19.5
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Loofah HTML5 APIs or scrub_html5_* methods in versions 2.21.0 through 2.25.3 are exposed when they use Nokogiri before 1.19.5. Loofah HTML4 APIs, Loofah::Helpers.sanitize, :whitewash, rails-html-sanitizer's default configuration, and JRuby are not affected.
What does an attacker need to exploit it?
An attacker needs a way to supply HTML that is sanitized through an affected HTML5 Loofah API or scrubber and then rendered by a browser. The exploit relies on MathML placing markup in an allowed attribute so browser reparsing turns the sanitized output into live HTML.
Which scrubber and browser combinations are affected?
The :strip scrubber is affected in every browser. The :prune and :escape scrubbers are affected in WebKit browsers.
What should be updated to remediate the issue?
Update Loofah to version 2.25.3. Affected usage also depends on Nokogiri versions before 1.19.5, which do not escape angle brackets in attribute values.