CVE-2026-126206: Loofah allowed_uri? treats data:text/html as safe text/plain
Summary
Loofah::HTML5::Scrub.alloweduri? returns true for a data: URI whose mediatype is written with the HTML5 named character reference / in place of the solidus. Loofah reads that mediatype as malformed and falls back to the allowed text/plain, while a browser decodes the reference and reads the same URI as text/html.
Details
alloweduri? decodes HTML entities with CGI.unescapeHTML, which handles numeric character references but not HTML5 named character references. / therefore survives normalization, so the mediatype carries no /, fails the MIME grammar, and falls back to the allowed text/plain under the WHATWG rule for a malformed mediatype.
:, /, 	 and 
 are the only named character references in the HTML5 table that decode to characters that change how a URI parses (U+003A, U+002F, U+0009 and U+000A; there is no named reference for U+000D), so this closes the set.
Loofah's default sanitize() path is not affected, because Nokogiri decodes the entity during parsing before Loofah evaluates the URI. This issue affects only callers of the public alloweduri? string-level helper that pass it HTML-encoded strings.
Impact
Applications that validate a user-controlled URL with Loofah::HTML5::Scrub.alloweduri? and then render the approved value into an href or another browser-interpreted URI attribute may be vulnerable to cross-site scripting. Rails::HTML::Sanitizer.alloweduri? re-exports the same helper.
Mitigation
Upgrade to Loofah >= 2.25.3.
Credit
Responsibly reported by GitHub user @ngpestelos.
Other sources
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.alloweduri? treats a data URI mediatype containing the HTML5 named solidus reference / as malformed and falls back to the allowed text/plain, while a browser decodes the reference and interprets the same value as text/html. An application that validates a user-controlled URL with this helper and renders the approved value in href or another browser-interpreted URI attribute can allow cross-site scripting. Rails::HTML::Sanitizer.alloweduri? re-exports the affected helper. Loofah's default sanitize() path is not affected because Nokogiri decodes the entity before URI validation. This issue is fixed in version 2.25.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/loofahto a version that resolves this vulnerability.Fixed in 2.25.3 - Upgrade
Upgrade
Loofahto a version that resolves this vulnerability.Fixed in 2.25.3
Event History
Frequently Asked Questions
Is the default sanitization path affected?
No. Loofah's default sanitize() path is not affected because Nokogiri decodes the entity during parsing before Loofah evaluates the URI.
Which uses are exposed?
The issue affects callers of the public allowed_uri? string-level helper that pass HTML-encoded strings to it. In particular, a data: URI with / in place of the slash can be treated as text/plain by the helper while a browser interprets it as text/html.
How can I determine whether my application is affected?
Audit uses of Loofah::HTML5::Scrub.allowed_uri? and identify whether it receives HTML-encoded URI strings. Inputs containing HTML5 named references that alter URI parsing, including :, /, 	, or 
, warrant review.