CVE-2026-73491 Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references
Attackers can bypass URI validation to inject JavaScript via whitespace character references, affecting applications using Loofah's allowed_uri? method directly.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73491?
CVE-2026-73491 is a low-severity cross-site scripting vulnerability in flavorjones loofah, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character references 	 or 
. CGI.unescapeHTML leaves those references intact, so allowed_uri? reports the URL safe even though a browser decodes and strips the tab or line feed and executes the resulting javascript: URL. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.
Weakness: CWE-184
Which versions are affected by CVE-2026-73491?
2 open source packages ship an affected version, including loofah.
| Package | Affected | Fixed in |
|---|---|---|
loofah RubyGems | From 2.25.0 | 2.25.2 |
loofah RubyGems | From 2.25.0 | 2.25.2 |
How do I fix CVE-2026-73491?
Upgrade loofah to 2.25.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-73491 being exploited?
There is no known exploitation of CVE-2026-73491 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-73491, GHSA-8whx-365g-h9vv, UBUNTU-CVE-2026-73491.