CVE-2026-73492: Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as :, 	, 
, or 
. CGI.unescapeHTML leaves these references encoded, so alloweduri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to alloweduri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Loofahto a version that resolves this vulnerability.Fixed in 2.25.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73492?
The severity of CVE-2026-73492 is rated at 47.
How do I fix CVE-2026-73492?
To fix CVE-2026-73492, update Loofah to version 2.25.3 or later.
What is the impact of CVE-2026-73492?
CVE-2026-73492 allows for the potential execution of XSS attacks through improperly validated `javascript:` URIs.
Which versions of Loofah are affected by CVE-2026-73492?
Loofah versions 2.25.0 to 2.25.2 are affected by CVE-2026-73492.
What type of vulnerability is CVE-2026-73492 classified as?
CVE-2026-73492 is classified as an XSS vulnerability.