CVE-2026-73492 Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons
Attackers can bypass URI sanitization in Loofah by using encoded characters, leading to XSS if HTML-encoded strings are passed directly to allowed_uri?.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73492?
CVE-2026-73492 is a low-severity cross-site scripting vulnerability in flavorjones loofah, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as :, 	, 
, or 
. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.
Which versions are affected by CVE-2026-73492?
2 open source packages ship an affected version, including loofah.
| Package | Affected | Fixed in |
|---|---|---|
loofah RubyGems | From 2.25.0 | 2.25.2 |
loofah RubyGems | From 2.25.0 | 2.25.2 |
How do I fix CVE-2026-73492?
Upgrade loofah to 2.25.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-73492 being exploited?
There is no known exploitation of CVE-2026-73492 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-73492, GHSA-5qhf-9phg-95m2, UBUNTU-CVE-2026-73492.