CVE-2026-126207: Loofah: CSS url() sanitization bypass via escaped parentheses
Summary
Loofah::HTML5::Scrub.scrubcss rejected any property whose top-level Crass tokens included a :url or :badurl, and left url out of the allowed CSS functions. Both checks ran only against the first parse of the style attribute. When scrubcss rebuilt each property it emitted identifiers with their CSS escapes decoded, so parentheses written as escapes — url\28 …\29 — hid the url token from the checks, and the rebuilt value was re-parsed into a live url() that nothing checked again. An escaped property name, six-digit escapes, escaped comments and escaped quotes all reached the same place.
Impact
A sanitized style attribute could make a viewer's browser issue a request to an attacker-chosen URL. list-style fetches on render with no interaction, cursor on hover. That leaks the viewer's IP address, user agent and access timing, and can reach hosts routable only from the viewer's network. No script survives sanitization and the attacker cannot read the response, so the request itself is the whole impact.
Applications that sanitize user-supplied HTML with Loofah's default allowlist and display it to other people are affected.
Mitigation
Upgrade to Loofah >= 2.25.3.
Credit
Reported by NotAFlightRisk through GitHub's private vulnerability reporting.
Other sources
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah::HTML5::Scrub.scrubcss checks only the first parse of a style attribute, then rebuilds CSS with identifier escapes decoded so escaped parentheses, property names, comments, or quotes can become a live url() without a second safety check. An attacker can use list-style to make a viewer's browser request an attacker-chosen URL when content renders, or cursor to make the request on hover. The request can disclose the viewer's IP address, user agent, access timing, and access to internal-network hosts, but no script survives sanitization and the attacker cannot read the response. This issue is fixed in version 2.25.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/loofahto a version that resolves this vulnerability.Fixed in 2.25.3 - Upgrade
Upgrade
Loofahto a version that resolves this vulnerability.Fixed in 2.25.3
Event History
Frequently Asked Questions
Which applications are realistically exposed?
Applications that sanitize user-supplied HTML using Loofah's default allowlist and then render that HTML for other users are affected. The issue is relevant where untrusted users can supply style attributes that will be displayed in another viewer's browser.
What does an attacker need to exploit this?
The attacker needs a way to submit HTML containing a crafted style attribute that passes through Loofah sanitization and is later rendered. Exploitation relies on CSS escapes, such as escaped parentheses in url(), to bypass the initial token checks.
Are default Loofah sanitization settings affected?
Yes. The described affected scenario explicitly includes applications using Loofah's default allowlist to sanitize user-supplied HTML.
What is the practical impact after successful exploitation?
A viewer's browser can request an attacker-chosen URL, potentially including hosts reachable only from that viewer's network. This can disclose the viewer's IP address, user agent, and access timing; the attacker cannot read the response, and no script survives sanitization.
Does exploitation require viewer interaction?
Not always. A list-style URL can be fetched when the content renders without interaction, while a cursor URL is fetched when the viewer hovers over the affected element.