CVE-2026-126208 Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction
Attackers can bypass Loofah's SVG local-reference restriction to make viewers fetch attacker-chosen URLs, leaking viewer network information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Harmful if only installed
- No
- Needs a specific call
- No
- Fix
- Available
What is CVE-2026-126208?
CVE-2026-126208 is a medium-severity security feature bypass vulnerability in flavorjones loofah, published on 12 Nov 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG_ALLOW_LOCAL_HREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external href and xlink:href values on those elements survive sanitization. Firefox fetches the attacker-chosen URL when a viewer renders the content, which can disclose the viewer's IP address, user agent, referrer, and access to hosts routable only from the viewer's network. Chrome and WebKit do not fetch these references, and the impact is a network request rather than script execution. The rails-html-sanitizer PermitScrubber reuses the affected safelist when SVG elements are permitted. This issue is fixed in version 2.25.3.
Which versions are affected by CVE-2026-126208?
1 open source package ship an affected version, including loofah.
An affected version is exposed as installed. No special setting or call is needed.
| Package | Affected | Fixed in |
|---|---|---|
loofah RubyGems | All versions | 2.25.3 |
How do I fix CVE-2026-126208?
Upgrade loofah to 2.25.3 or later.
Upgrade to the fixed version, and do not rely on a single control for protection. More about Security feature bypass.
Is CVE-2026-126208 being exploited?
There is no known exploitation of CVE-2026-126208 in the wild and no public exploit code.
Sources
Also known as GHSA-345x-3rq2-jfrm.