What’s Vulnerable › Vulnerabilities

CVE-2026-73490: Loofah: SVG `href` attribute bypasses local-reference restriction

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-12 · updated 2026-10-24
• Weakness: CWE-79

Description

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept the plain href attribute. A crafted sanitized SVG can therefore reference an arbitrary same-origin external document; use may render external SVG content containing scripts or other dangerous content, and feImage may load external images for tracking. Applications that sanitize user-supplied SVG with Loofah's default allowlist are affected. This issue is fixed in version 2.25.2.

Affected products

• Rubygems Loofah: before 2.25.2; 0.2.0, 0.2.1, 0.2.2, 0.3.0, 0.3.1, 0.4.0 (+58) — fixed in 2.25.2
• flavorjones loofah: before 2.25.2

How to fix

Upgrade to a fixed version: Rubygems Loofah 2.25.2. Check the vendor advisory for mitigations.

References

• https://github.com/flavorjones/loofah/commit/20867b9be689521887364b74822c41ef830523c9
• https://github.com/flavorjones/loofah/pull/308
• https://github.com/flavorjones/loofah/releases/tag/v2.25.2
• https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf

Get alerted when CVE-2026-73490 or the next vulnerability affects your stack