CVE-2026-73490: Loofah HTML5 Sanitizer XSS Vulnerability

CVE-2026-73490 Overview

CVE-2026-73490 is a sanitizer bypass in Loofah, a Ruby library for HTML/XML sanitization built on top of Nokogiri. Prior to version 2.25.2, Loofah's HTML5 sanitizer enforced its local-reference restriction only on the xlink:href attribute of SVG use and feImage elements. Modern browsers also honor the plain href attribute on these elements, which the sanitizer failed to constrain. A crafted SVG payload can reference an arbitrary same-origin external document, enabling use to render remote SVG content containing scripts and enabling feImage to load external resources for tracking. Applications that sanitize user-supplied SVG with Loofah's default allowlist are affected.

Critical Impact
A crafted SVG can bypass Loofah's sanitizer to fetch and render same-origin external content, resulting in cross-site scripting [CWE-79] and user tracking.

Affected Products

Loofah Ruby gem versions prior to 2.25.2
Ruby applications using Loofah's HTML5 sanitizer with the default allowlist to process user-supplied SVG
Downstream libraries and frameworks (for example, rails-html-sanitizer) that depend on affected Loofah versions

Discovery Timeline

2026-08-12 - CVE-2026-73490 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73490

Vulnerability Analysis

Loofah's HTML5 safelist maintains an SVG_ALLOW_LOCAL_HREF set that enumerates SVG elements permitted to reference only local (same-document, fragment identifier) targets. The sanitizer checked whether the attribute name equaled xlink:href and, if the referenced value was not a fragment beginning with #, removed the attribute. Because browsers accept both the XLink-namespaced xlink:href and the plain SVG 2 href attribute on elements such as use and feImage, an attacker can supply the unqualified href variant to bypass the check.

When the sanitized SVG is rendered in a victim's browser, <use href="..."> can pull an external SVG document containing <script> or event-handler content, executing script in the loading origin. The <feImage href="..."> variant triggers external resource loads suitable for pixel-style tracking or exfiltration signaling. The impact is bounded by browser same-origin rules for use, so the practical risk is highest in applications that host attacker-controlled and victim content under the same origin.

Root Cause

The root cause is an incomplete attribute allowlist. The scrub.rb local-reference enforcement compared attr_name == "xlink:href" in isolation, ignoring the semantically equivalent plain href attribute that browsers accept on SVG elements per the SVG 2 specification.

Attack Vector

Exploitation requires an application that accepts and sanitizes user-supplied SVG or HTML with embedded SVG using Loofah's default HTML5 allowlist, then serves the sanitized markup to other users. The attacker submits a crafted SVG containing a use or feImage element whose plain href attribute references an external same-origin document. User interaction is required to load the resulting page.

ruby

# Security patch: lib/loofah/html5/safelist.rb
         "stroke",
       ])
 
+      SVG_HREF_ATTRIBUTES = Set.new([
+        "xlink:href",
+        "href",
+      ])
+
       SVG_ALLOW_LOCAL_HREF = Set.new([
         "altGlyph",
         "animate",

# Security patch: lib/loofah/html5/scrub.rb
             end
 
             next unless SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) &&
-              attr_name == "xlink:href" &&
+              SafeList::SVG_HREF_ATTRIBUTES.include?(attr_name) &&
               attr_node.value =~ /^\s*[^#\s].*/m
 
             attr_node.remove

Source: GitHub Commit 20867b9. The patch introduces a SVG_HREF_ATTRIBUTES set covering both xlink:href and href, and updates the scrubber to enforce the local-reference restriction on either attribute name.

Detection Methods for CVE-2026-73490

Indicators of Compromise

Stored or reflected SVG content containing <use> or <feImage> elements with an href attribute whose value does not begin with #
Outbound browser requests from application pages to unexpected same-origin URLs immediately after rendering user-supplied SVG
Content Security Policy violation reports naming SVG use external references or unexpected script execution in pages that render user content

Detection Strategies

Perform a dependency inventory of Ruby applications and identify any loofah gem version prior to 2.25.2 via bundle list loofah or Gemfile.lock inspection.
Scan stored user-generated content in databases and object storage for SVG payloads matching regex <(use|feImage)[^>]+\shref= where the value does not start with #.
Add unit tests that pass known bypass fixtures through the application's sanitization pipeline and assert that href attributes on use and feImage are stripped.

Monitoring Recommendations

Enable and monitor CSP report-uri or report-to endpoints for violations involving SVG external references on pages serving user content.
Log and alert on ingestion of SVG uploads that contain use or feImage elements referencing non-fragment URLs.
Track versions of loofah and dependent gems such as rails-html-sanitizer in software composition analysis tooling to identify regression to a vulnerable version.

How to Mitigate CVE-2026-73490

Immediate Actions Required

Upgrade the loofah gem to version 2.25.2 or later in every application and container image, then redeploy.
Rebuild and republish any previously sanitized user-supplied SVG content through the patched sanitizer to remove pre-existing bypass payloads.
Audit downstream sanitization consumers (for example, rails-html-sanitizer) and upgrade them to versions that depend on the patched Loofah release.

Patch Information

The fix is included in Loofah 2.25.2. Refer to the GitHub Security Advisory GHSA-9wjq-cp2p-hrgf, the upstream Pull Request 308, and the v2.25.2 Release Notes for the patch details and release artifacts.

Workarounds

Strip all <use> and <feImage> elements from user-supplied SVG before or after sanitization until the upgrade is applied.
Deploy a strict Content Security Policy that forbids inline scripts and restricts image and object sources to trusted origins, reducing the impact of a successful bypass.
Serve user-uploaded SVG from a separate, sandboxed origin so that same-origin references cannot reach sensitive application URLs.

bash

# Upgrade Loofah to the patched version
bundle update loofah --conservative
bundle list loofah  # verify 2.25.2 or later is installed

# Verify no vulnerable versions remain in the lockfile
grep -A1 '^  loofah' Gemfile.lock