CVE-2026-126207 Loofah: CSS url() sanitization bypass via escaped parentheses
Attackers can bypass Loofah's CSS url() sanitization with escaped parentheses to make viewers' browsers request attacker-chosen URLs, leaking IP and user agent data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Harmful if only installed
- No
- Needs a specific call
- No
- Fix
- Available
What is CVE-2026-126207?
CVE-2026-126207 is a medium-severity security feature bypass vulnerability in flavorjones loofah, published on 12 Nov 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah::HTML5::Scrub.scrub_css checks only the first parse of a style attribute, then rebuilds CSS with identifier escapes decoded so escaped parentheses, property names, comments, or quotes can become a live url() without a second safety check. An attacker can use list-style to make a viewer's browser request an attacker-chosen URL when content renders, or cursor to make the request on hover. The request can disclose the viewer's IP address, user agent, access timing, and access to internal-network hosts, but no script survives sanitization and the attacker cannot read the response. This issue is fixed in version 2.25.3.
Which versions are affected by CVE-2026-126207?
1 open source package ship an affected version, including loofah.
An affected version is exposed as installed. No special setting or call is needed.
| Package | Affected | Fixed in |
|---|---|---|
loofah RubyGems | All versions | 2.25.3 |
How do I fix CVE-2026-126207?
Upgrade loofah to 2.25.3 or later.
Upgrade to the fixed version, and do not rely on a single control for protection. More about Security feature bypass.
Is CVE-2026-126207 being exploited?
There is no known exploitation of CVE-2026-126207 in the wild and no public exploit code.
Sources
Also known as GHSA-m3x9-938q-5767.