Vulnerability-Lookup

CVE-2026-73492 (GCVE-0-2026-73492)

Vulnerability from cvelistv5 – Published: 2026-08-12 21:00 – Updated: 2026-08-14 22:18

Title

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Summary

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as &#58, &#9, &#10, or &#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 22:17 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-184 - Incomplete List of Disallowed Inputs

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7820 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/flavorjones/loofah/security/ad…	x_refsource_CONFIRM
https://github.com/flavorjones/loofah/pull/308	x_refsource_MISC
https://github.com/flavorjones/loofah/commit/f1be…	x_refsource_MISC
https://github.com/flavorjones/loofah/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
flavorjones	loofah	Affected: >= 2.25.0, < 2.25.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73492",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T22:17:58.982852Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T22:18:10.839Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "loofah",
          "vendor": "flavorjones",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.25.0, \u003c 2.25.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as \u0026#58, \u0026#9, \u0026#10, or \u0026#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah\u0027s default sanitize() path is not affected. This issue is fixed in version 2.25.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184: Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T21:00:24.679Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2"
        },
        {
          "name": "https://github.com/flavorjones/loofah/pull/308",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/flavorjones/loofah/pull/308"
        },
        {
          "name": "https://github.com/flavorjones/loofah/commit/f1be9d893b5a8dd79240441a912d8897e74c38c0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/flavorjones/loofah/commit/f1be9d893b5a8dd79240441a912d8897e74c38c0"
        },
        {
          "name": "https://github.com/flavorjones/loofah/releases/tag/v2.25.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/flavorjones/loofah/releases/tag/v2.25.2"
        }
      ],
      "source": {
        "advisory": "GHSA-5qhf-9phg-95m2",
        "discovery": "UNKNOWN"
      },
      "title": "Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73492",
    "datePublished": "2026-08-12T21:00:24.679Z",
    "dateReserved": "2026-08-12T19:00:33.735Z",
    "dateUpdated": "2026-08-14T22:18:10.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73492",
      "date": "2026-11-12",
      "epss": "0.00394",
      "percentile": "0.34122"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "loofah",
                "vendor": "flavorjones",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 2.25.0, \u003c 2.25.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as \u0026#58, \u0026#9, \u0026#10, or \u0026#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah\u0027s default sanitize() path is not affected. This issue is fixed in version 2.25.2."
          },
          {
            "lang": "es",
            "value": "Loofah es una biblioteca general para manipular y transformar documentos y fragmentos HTML/XML, construida sobre Nokogiri. Desde la versi\u00f3n 2.25.0 hasta la 2.25.2, Loofah::HTML5::Scrub.allowed_uri? no rechaza URIs javascript_disabled: o vbscript: cuyo esquema est\u00e1 dividido por referencias de caracteres num\u00e9ricos sin punto y coma como  y #58,  y #9,  y #10, o  y #13. CGI.unescapeHTML deja estas referencias codificadas, por lo que allowed_uri? informa que la URL es segura a pesar de que un navegador decodifica un colon codificado o elimina espacios en blanco codificados y ejecuta el esquema URI resultante. Este problema afecta solo a los llamadores que pasan cadenas codificadas en HTML directamente a allowed_uri?; la ruta sanitize() predeterminada de Loofah no se ve afectada. Este problema est\u00e1 solucionado en la versi\u00f3n 2.25.2."
          }
        ],
        "id": "CVE-2026-73492",
        "lastModified": "2026-10-24T15:10:00.190",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "HIGH",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 2.3,
                "baseSeverity": "LOW",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-73492",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T22:17:58.982852Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-12T22:17:16.527",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/flavorjones/loofah/commit/f1be9d893b5a8dd79240441a912d8897e74c38c0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/flavorjones/loofah/pull/308"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/flavorjones/loofah/releases/tag/v2.25.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              },
              {
                "lang": "en",
                "value": "CWE-184"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-11-07T11:11:28+00:00",
      "cve": "CVE-2026-73492",
      "id": "CVE-2026-73492",
      "initial_release_date": "2026-08-12T21:00:24.679000+00:00",
      "product_status:known_affected": "3",
      "product_status:known_not_affected": "4",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "rubygem-loofah: Loofah: Arbitrary code execution due to URI scheme bypass",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73492.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-73492",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-14T22:17:58.982852Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-14T22:18:06.339Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "loofah",
              "vendor": "flavorjones",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 2.25.0, \u003c 2.25.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as \u0026#58, \u0026#9, \u0026#10, or \u0026#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah\u0027s default sanitize() path is not affected. This issue is fixed in version 2.25.2."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "HIGH",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 2.3,
                "baseSeverity": "LOW",
                "privilegesRequired": "LOW",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-184",
                  "description": "CWE-184: Incomplete List of Disallowed Inputs",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-12T21:00:24.679Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2"
            },
            {
              "name": "https://github.com/flavorjones/loofah/pull/308",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/flavorjones/loofah/pull/308"
            },
            {
              "name": "https://github.com/flavorjones/loofah/commit/f1be9d893b5a8dd79240441a912d8897e74c38c0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/flavorjones/loofah/commit/f1be9d893b5a8dd79240441a912d8897e74c38c0"
            },
            {
              "name": "https://github.com/flavorjones/loofah/releases/tag/v2.25.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/flavorjones/loofah/releases/tag/v2.25.2"
            }
          ],
          "source": {
            "advisory": "GHSA-5qhf-9phg-95m2",
            "discovery": "UNKNOWN"
          },
          "title": "Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-73492",
        "datePublished": "2026-08-12T21:00:24.679Z",
        "dateReserved": "2026-08-12T19:00:33.735Z",
        "dateUpdated": "2026-08-14T22:18:10.839Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-73492

Vulnerability from fkie_nvd - Published: 2026-08-12 22:17 - Updated: 2026-10-24 15:10

Severity

2.3 (Low) - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/flavorjones/loofah/commit/f1be9d893b5a8dd79240441a912d8897e74c38c0
	security-advisories@github.com	https://github.com/flavorjones/loofah/pull/308
	security-advisories@github.com	https://github.com/flavorjones/loofah/releases/tag/v2.25.2
	security-advisories@github.com	https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "loofah",
          "vendor": "flavorjones",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.25.0, \u003c 2.25.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as \u0026#58, \u0026#9, \u0026#10, or \u0026#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah\u0027s default sanitize() path is not affected. This issue is fixed in version 2.25.2."
    },
    {
      "lang": "es",
      "value": "Loofah es una biblioteca general para manipular y transformar documentos y fragmentos HTML/XML, construida sobre Nokogiri. Desde la versi\u00f3n 2.25.0 hasta la 2.25.2, Loofah::HTML5::Scrub.allowed_uri? no rechaza URIs javascript_disabled: o vbscript: cuyo esquema est\u00e1 dividido por referencias de caracteres num\u00e9ricos sin punto y coma como  y #58,  y #9,  y #10, o  y #13. CGI.unescapeHTML deja estas referencias codificadas, por lo que allowed_uri? informa que la URL es segura a pesar de que un navegador decodifica un colon codificado o elimina espacios en blanco codificados y ejecuta el esquema URI resultante. Este problema afecta solo a los llamadores que pasan cadenas codificadas en HTML directamente a allowed_uri?; la ruta sanitize() predeterminada de Loofah no se ve afectada. Este problema est\u00e1 solucionado en la versi\u00f3n 2.25.2."
    }
  ],
  "id": "CVE-2026-73492",
  "lastModified": "2026-10-24T15:10:00.190",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.3,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73492",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-14T22:17:58.982852Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-12T22:17:16.527",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/flavorjones/loofah/commit/f1be9d893b5a8dd79240441a912d8897e74c38c0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/flavorjones/loofah/pull/308"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/flavorjones/loofah/releases/tag/v2.25.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-184"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-5QHF-9PHG-95M2

Vulnerability from github – Published: 2026-07-21 22:03 – Updated: 2026-07-21 22:03

Summary

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Details

Summary

Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript: or vbscript: URIs when the scheme is split by a numeric character reference that has no trailing semicolon. A browser decodes such references and resolves the URL to an executable javascript: scheme, while allowed_uri? reports it safe.

This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled numeric character references with a trailing ; (	, 
, ) but did not cover the forms without semicolons.

Details

allowed_uri? decodes HTML entities with CGI.unescapeHTML, which decodes numeric character references only when they carry a trailing ;. A reference without a semicolon such as : (colon) or 	 (tab) is left literal, so the scheme-detection check finds no scheme, and the method falls through to its scheme-less path and returns true.

A browser, however, decodes numeric character references even without a trailing semicolon. An encoded colon such as : becomes the : scheme separator, so javascript&#58alert(1) resolves to javascript:alert(1). Encoded whitespace such as &#9 (tab) is decoded and then stripped from the URL, rejoining the surrounding text, so java&#9script:alert(1) also resolves to javascript:alert(1). In both cases the URL executes while allowed_uri? approved it as safe.

Note that Loofah's default sanitize() path is not affected, because Nokogiri decodes or entity-escapes HTML entities during parsing before Loofah evaluates the URI protocol. This issue only affects callers of the public allowed_uri? string-level helper that pass it HTML-encoded strings.

Impact

Callers that validate a user-controlled URL with Loofah::HTML5::Scrub.allowed_uri? and then render the approved value into an href or other browser-interpreted URI attribute may be vulnerable to cross-site scripting (XSS). This includes applications that call allowed_uri? directly, as well as higher-level features built on top of it, such as Action Text 8.2's markdown link validation.

Mitigation

Upgrade to Loofah >= 2.25.2.

Credit

Responsibly reported by GitHub user @MoonFuji.

Severity

2.3 (Low)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "loofah"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.25.0"
            },
            {
              "fixed": "2.25.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-184",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-21T22:03:11Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "## Summary\n\n`Loofah::HTML5::Scrub.allowed_uri?` does not correctly reject `javascript:` or `vbscript:` URIs when the scheme is split by a numeric character reference that has no trailing semicolon. A browser decodes such references and resolves the URL to an executable `javascript:` scheme, while `allowed_uri?` reports it safe.\n\nThis is a bypass of the fix for [GHSA-46fp-8f5p-pf2m](https://github.com/flavorjones/loofah/security/advisories/GHSA-46fp-8f5p-pf2m), which handled numeric character references with a trailing `;` (`\u0026#9;`, `\u0026#10;`, `\u0026#13;`) but did not cover the forms without semicolons.\n\n## Details\n\n`allowed_uri?` decodes HTML entities with `CGI.unescapeHTML`, which decodes numeric character references only when they carry a trailing `;`. A reference without a semicolon such as `\u0026#58` (colon) or `\u0026#9` (tab) is left literal, so the scheme-detection check finds no scheme, and the method falls through to its scheme-less path and returns `true`.\n\nA browser, however, decodes numeric character references even without a trailing semicolon. An encoded colon such as `\u0026#58` becomes the `:` scheme separator, so `javascript\u0026#58alert(1)` resolves to `javascript:alert(1)`. Encoded whitespace such as `\u0026#9` (tab) is decoded and then stripped from the URL, rejoining the surrounding text, so `java\u0026#9script:alert(1)` also resolves to `javascript:alert(1)`. In both cases the URL executes while `allowed_uri?` approved it as safe.\n\nNote that Loofah\u0027s default `sanitize()` path is **not** affected, because Nokogiri decodes or entity-escapes HTML entities during parsing before Loofah evaluates the URI protocol. This issue only affects callers of the public `allowed_uri?` string-level helper that pass it HTML-encoded strings.\n\n## Impact\n\nCallers that validate a user-controlled URL with `Loofah::HTML5::Scrub.allowed_uri?` and then render the approved value into an `href` or other browser-interpreted URI attribute may be vulnerable to cross-site scripting (XSS). This includes applications that call `allowed_uri?` directly, as well as higher-level features built on top of it, such as Action Text 8.2\u0027s markdown link validation.\n\n## Mitigation\n\nUpgrade to Loofah \u003e= 2.25.2.\n\n## Credit\n\nResponsibly reported by GitHub user @MoonFuji.",
  "id": "GHSA-5qhf-9phg-95m2",
  "modified": "2026-07-21T22:03:11Z",
  "published": "2026-07-21T22:03:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flavorjones/loofah/commit/f1be9d893b5a8dd79240441a912d8897e74c38c0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/flavorjones/loofah"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flavorjones/loofah/releases/tag/v2.25.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons"
}

UBUNTU-CVE-2026-73492 (CVE-2026-73492)

Vulnerability from osv_ubuntu – Published: 2026-08-12 22:17 – Updated: 2026-10-17 09:51 – Source website

Details

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as :, , , or . CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

Severity

2.3 (Low)


                    
                      CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-73492	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-73492	REPORT
	https://github.com/flavorjones/loofah/security/ad…	REPORT
	https://github.com/flavorjones/loofah/pull/308	REPORT
	https://github.com/flavorjones/loofah/commit/f1be…	REPORT
	https://github.com/flavorjones/loofah/releases/ta…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ruby-loofah",
            "binary_version": "2.0.3-2+deb9u3build0.16.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "ruby-loofah",
        "purl": "pkg:deb/ubuntu/ruby-loofah@2.0.3-2+deb9u3build0.16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.2-1",
        "2.0.3-1",
        "2.0.3-2",
        "2.0.3-2+deb9u1build0.16.04.1",
        "2.0.3-2+deb9u2build0.16.04.1",
        "2.0.3-2+deb9u3build0.16.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ruby-loofah",
            "binary_version": "2.2.2-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "ruby-loofah",
        "purl": "pkg:deb/ubuntu/ruby-loofah@2.2.2-1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.3-2",
        "2.2.2-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ruby-loofah",
            "binary_version": "2.4.0+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "ruby-loofah",
        "purl": "pkg:deb/ubuntu/ruby-loofah@2.4.0+dfsg-1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.2.3-1",
        "2.3.1+dfsg-1",
        "2.4.0+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ruby-loofah",
            "binary_version": "2.13.0-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "ruby-loofah",
        "purl": "pkg:deb/ubuntu/ruby-loofah@2.13.0-2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.12.0-1",
        "2.13.0-1",
        "2.13.0-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ruby-loofah",
            "binary_version": "2.22.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "ruby-loofah",
        "purl": "pkg:deb/ubuntu/ruby-loofah@2.22.0-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.21.3-1",
        "2.21.4-1",
        "2.22.0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ruby-loofah",
            "binary_version": "2.25.2-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "ruby-loofah",
        "purl": "pkg:deb/ubuntu/ruby-loofah@2.25.2-1?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.25.0-1",
        "2.25.1-2",
        "2.25.2-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ruby-loofah",
            "binary_version": "2.25.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "ruby-loofah",
        "purl": "pkg:deb/ubuntu/ruby-loofah@2.25.0-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.24.1-1",
        "2.25.0-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as \u0026#58, \u0026#9, \u0026#10, or \u0026#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah\u0027s default sanitize() path is not affected. This issue is fixed in version 2.25.2.",
  "id": "UBUNTU-CVE-2026-73492",
  "modified": "2026-10-17T09:51:13Z",
  "published": "2026-08-12T22:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-73492"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73492"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/flavorjones/loofah/pull/308"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/flavorjones/loofah/commit/f1be9d893b5a8dd79240441a912d8897e74c38c0"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/flavorjones/loofah/releases/tag/v2.25.2"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-73492"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-73492 (GCVE-0-2026-73492)

FKIE_CVE-2026-73492

GHSA-5QHF-9PHG-95M2

Summary

Details

Impact

Mitigation

Credit

UBUNTU-CVE-2026-73492 (CVE-2026-73492)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour