CVE-2026-73491: Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character references 	 or 
. CGI.unescapeHTML leaves those references intact, so alloweduri? reports the URL safe even though a browser decodes and strips the tab or line feed and executes the resulting javascript: URL. This issue affects only callers that pass HTML-encoded strings directly to alloweduri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
loofahto a version that resolves this vulnerability.Fixed in 2.25.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73491?
The severity of CVE-2026-73491 is 55.
How do I fix CVE-2026-73491?
To fix CVE-2026-73491, upgrade Loofah to version 2.25.3 or later.
What does CVE-2026-73491 affect?
CVE-2026-73491 affects Loofah versions 2.25.0 to 2.25.2.
What type of vulnerability is CVE-2026-73491?
CVE-2026-73491 is a URI validation vulnerability in the Loofah library.
What can happen if CVE-2026-73491 is exploited?
If exploited, CVE-2026-73491 can allow JavaScript execution via manipulated URI inputs.