CVE-2026-126203 Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values
Attackers can bypass Loofah's HTML5 sanitizers with MathML markup in attributes, producing live HTML in apps relying on it.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Harmful if only installed
- No
- Needs a specific call
- Yes
- Fix
- Available
What is CVE-2026-126203?
CVE-2026-126203 is a medium-severity cross-site scripting vulnerability in flavorjones loofah, published on 12 Nov 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5_fragment, Loofah.html5_document, and the scrub_html5_* methods can emit sanitized output that a browser reparses as different markup when used with Nokogiri before 1.19.5, because those Nokogiri versions do not escape angle brackets in attribute values. MathML can place markup inside an allowed attribute so the reparsed output becomes live HTML. The :strip scrubber is affected in every browser, while :prune and :escape are affected in WebKit browsers. Loofah's HTML4 APIs, Loofah::Helpers.sanitize, :whitewash, rails-html-sanitizer's default configuration, and JRuby are not affected. This issue is fixed in version 2.25.3.
Which versions are affected by CVE-2026-126203?
1 open source package ship an affected version, including loofah.
An affected version is only exploitable if your software calls Loofah.html5_fragment, Loofah.html5_document or scrub_html5_*. Many projects that include it are not exposed.
| Package | Affected | Fixed in |
|---|---|---|
loofah RubyGems | From 2.21.0 | 2.25.3 |
How do I fix CVE-2026-126203?
Upgrade loofah to 2.25.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-126203 being exploited?
There is no known exploitation of CVE-2026-126203 in the wild and no public exploit code.
Sources
Also known as GHSA-h6v6-rg66-fqj4.