CVE-2026-73490: Loofah: SVG `href` attribute bypasses local-reference restriction
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept the plain href attribute. A crafted sanitized SVG can therefore reference an arbitrary same-origin external document; use may render external SVG content containing scripts or other dangerous content, and feImage may load external images for tracking. Applications that sanitize user-supplied SVG with Loofah's default allowlist are affected. This issue is fixed in version 2.25.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Loofahto a version that resolves this vulnerability.Fixed in 2.25.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73490?
The severity of CVE-2026-73490 is medium with a score of 4.7.
How do I fix CVE-2026-73490?
To fix CVE-2026-73490, upgrade to Loofah version 2.25.2 or later.
What is the risk associated with CVE-2026-73490?
CVE-2026-73490 poses a risk level of 31 due to its potential for XSS exploits.
What component of Loofah is affected by CVE-2026-73490?
CVE-2026-73490 affects the handling of the SVG href attribute in Loofah's HTML5 sanitizer.
What type of vulnerability is CVE-2026-73490 classified as?
CVE-2026-73490 is classified as a Cross-Site Scripting (XSS) vulnerability.