CVE-2026-126208: Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction
Summary
Loofah restricts href and xlink:href on certain SVG elements to same-document references. Two elements escaped the restriction:
- <textPath>: SVGALLOWLOCALHREF listed it in lowercase as textpath, but the HTML5 parser names the element textPath inside <svg>, so the check never matched on the HTML5 path. - <mpath>: absent from SVGALLOWLOCALHREF, so its references were never restricted on either path.
rails-html-sanitizer reuses this safelist in its PermitScrubber, so it is affected too.
Impact
An external href or xlink:href on <textPath> or <mpath> survives sanitization. Firefox fetches the URL when rendering the content, which leaks the viewer's IP address, user agent, and referrer, and can reach hosts routable only from the viewer's network. Chrome and WebKit do not fetch external references on these elements. The impact is a network request to an attacker-chosen URL, not script execution.
Applications that sanitize user-supplied SVG, directly or inside HTML, with Loofah's default allowlist or with rails-html-sanitizer with SVG elements permitted are affected.
Mitigation
Upgrade to Loofah >= 2.25.3.
Other sources
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVGALLOWLOCALHREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external href and xlink:href values on those elements survive sanitization. Firefox fetches the attacker-chosen URL when a viewer renders the content, which can disclose the viewer's IP address, user agent, referrer, and access to hosts routable only from the viewer's network. Chrome and WebKit do not fetch these references, and the impact is a network request rather than script execution. The rails-html-sanitizer PermitScrubber reuses the affected safelist when SVG elements are permitted. This issue is fixed in version 2.25.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/loofahto a version that resolves this vulnerability.Fixed in 2.25.3 - Upgrade
Upgrade
Loofahto a version that resolves this vulnerability.Fixed in 2.25.3
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications that sanitize user-supplied SVG, either standalone or embedded in HTML, using Loofah’s default allowlist are affected. Applications using rails-html-sanitizer’s PermitScrubber are also affected when SVG elements are permitted.
What does an attacker need to do to exploit it?
An attacker needs to supply SVG content containing a textPath or mpath element with an external href or xlink:href that survives sanitization. A victim must render the sanitized content in Firefox for the external URL to be fetched.
What is the practical impact of a successful exploit?
Firefox can make a network request to an attacker-chosen URL, exposing the viewer’s IP address, user agent, and referrer. The request may also reach hosts that are routable only from the viewer’s network; this is not script execution.
Are all browsers affected?
No. Firefox fetches external references on these elements when rendering the content, while Chrome and WebKit do not fetch them.
What version resolves the issue?
Upgrade Loofah to version 2.25.3 or later.