CVE-2026-73491: Loofah Library XSS Vulnerability

CVE-2026-73491 Overview

CVE-2026-73491 is a sanitizer bypass in Loofah, a Ruby library for manipulating and transforming HTML/XML documents built on top of Nokogiri. Versions from 2.25.0 up to 2.25.2 contain a flaw in Loofah::HTML5::Scrub.allowed_uri? that fails to reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character references or . Browsers decode and strip these references, then execute the resulting javascript: URL. The issue only affects callers that pass HTML-encoded strings directly to allowed_uri?; the default sanitize() path is unaffected. The flaw is fixed in Loofah 2.25.2.

Critical Impact
Applications calling allowed_uri? directly on HTML-encoded input can be tricked into treating javascript: URIs as safe, enabling script execution in the browser context.

Affected Products

Loofah 2.25.0
Loofah 2.25.1
Ruby applications using Loofah::HTML5::Scrub.allowed_uri? on HTML-encoded input

Discovery Timeline

2026-08-12 - CVE-2026-73491 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73491

Vulnerability Analysis

The vulnerability is an incomplete input validation flaw classified under [CWE-184] (Incomplete List of Disallowed Inputs). Loofah's allowed_uri? method relies on CGI.unescapeHTML to normalize URI strings before scheme inspection. CGI.unescapeHTML decodes numeric and common named entities but leaves the HTML5 named whitespace references and intact.

When an attacker constructs a URI such as java script:alert(1) or javascript:alert(1), allowed_uri? sees a string that does not begin with javascript: and returns a safe verdict. However, browsers decode these named references during URL processing and strip tab and line-feed characters from the scheme, executing the underlying javascript: payload.

Root Cause

The scheme allowlist check trusts CGI.unescapeHTML to produce a fully normalized string. Because the underlying Ruby standard library does not decode the HTML5 named references (U+0009) and (U+000A), the scheme comparison operates on unnormalized input and reaches a different conclusion than the browser parser.

Attack Vector

Exploitation requires an application that passes HTML-encoded URI strings directly to Loofah::HTML5::Scrub.allowed_uri? and then renders the resulting URI in a browser context. An attacker supplies a crafted href or src value containing or inside the javascript scheme. The sanitizer approves the URI, and the browser executes the script when a user interacts with the rendered element.

ruby

         \z
       }x
 
+      # HTML5 named character references for whitespace that browsers strip from
+      # URIs. CGI.unescapeHTML does not decode these, so they are handled explicitly.
+      WHITESPACE_CHARACTER_REFERENCES = /&(Tab|NewLine);/
+
       class << self
         def allowed_element?(element_name)
           ::Loofah::HTML5::SafeList::ALLOWED_ELEMENTS_WITH_LIBXML2.include?(element_name)

Source: Loofah commit 5e91af8. The patch introduces the WHITESPACE_CHARACTER_REFERENCES regex and updates allowed_uri? to strip and before scheme validation.

Detection Methods for CVE-2026-73491

Indicators of Compromise

URI attributes (href, src, action) containing the substrings or inside or before a javascript scheme.
Sanitizer-approved URLs where the decoded browser representation differs from the stored value.
Reflected or stored user-controlled links that pass through custom code paths invoking Loofah::HTML5::Scrub.allowed_uri?.

Detection Strategies

Perform a static search across Ruby codebases for direct calls to Loofah::HTML5::Scrub.allowed_uri? and audit their input sources.
Add regression tests that supply inputs such as java script:alert(1) and javascript:alert(1) to sanitization helpers.
Enable Content Security Policy (CSP) reporting to surface unexpected inline script execution originating from user-supplied links.

Monitoring Recommendations

Log and alert on HTTP responses containing sanitized user content where URI attributes include or .
Monitor CSP violation reports for script-src violations tied to user-generated content endpoints.
Track dependency inventories for pinned versions of Loofah 2.25.0 or 2.25.1 and flag them for upgrade.

How to Mitigate CVE-2026-73491

Immediate Actions Required

Upgrade Loofah to version 2.25.2 or later in all Ruby applications and container images.
Audit application code for direct callers of Loofah::HTML5::Scrub.allowed_uri? and route sanitization through Loofah.sanitize() where possible.
Deploy a strict Content Security Policy that disallows inline script execution as a defense-in-depth control.

Patch Information

The fix is available in Loofah v2.25.2 and merged via pull request #308. Full technical details are documented in GHSA-8whx-365g-h9vv. Update the gem dependency and redeploy.

Workarounds

Pre-process user input to strip or reject the substrings and before invoking allowed_uri?.
Prefer the default Loofah.sanitize() API, which is not affected by this issue.
Reject any URI value whose scheme, after HTML entity decoding and whitespace stripping, resolves to javascript, data, or vbscript.

bash

# Update Loofah in your Gemfile
bundle update loofah --patch

# Verify the installed version
bundle exec ruby -e 'require "loofah"; puts Loofah::VERSION'
# Expected output: 2.25.2 or later