{"affected":[{"product":"loofah","source":"CNA: GitHub_M","vendor":"flavorjones","versions":[{"status":"affected","version":"= 2.25.2"}]},{"defaultStatus":"unaffected","ecosystem":"RubyGems","packageName":"loofah","product":"loofah","source":"OSV GHSA-jcff-cj73-4w4f","vendor":"","versions":[{"status":"affected","version":"2.25.2","versionType":"RubyGems"},{"events":[{"introduced":"2.25.2"},{"fixed":"2.25.3"}],"status":"unknown","version":"2.25.2","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-126206","cwes":["CWE-79","CWE-184"],"description":"Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.allowed_uri? treats a data URI mediatype containing the HTML5 named solidus reference / as malformed and falls back to the allowed text/plain, while a browser decodes the reference and interprets the same value as text/html. An application that validates a user-controlled URL with this helper and renders the approved value in href or another browser-interpreted URI attribute can allow cross-site scripting. Rails::HTML::Sanitizer.allowed_uri? re-exports the affected helper. Loofah's default sanitize() path is not affected because Nokogiri decodes the entity before URI validation. This issue is fixed in version 2.25.3.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0"}],"modifiedAt":1794517203782,"publishedAt":1794516696537,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-jcff-cj73-4w4f"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/flavorjones/loofah/pull/324"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/flavorjones/loofah/commit/ad92002966053309f83b550861e2ef04bc714744"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-jcff-cj73-4w4f"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-jcff-cj73-4w4f"}],"remediation":[{"kind":"fix","source":"OSV GHSA-jcff-cj73-4w4f","text":"loofah (RubyGems): OSV reports a fixed version 2.25.3. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-jcff-cj73-4w4f"}],"revision":"1bf56c5067854207c399fd552269d3d809bb259882423272c4dc1ecfea8ad437","sources":[{"modifiedAt":1794516696537,"name":"CNA: GitHub_M","retrievedAt":1794517745536,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126206"},{"modifiedAt":1794517203782,"name":"OSV / GitHub Security Advisories","retrievedAt":1794517746230,"url":"https://osv.dev/vulnerability/GHSA-jcff-cj73-4w4f"}],"ssvc":null,"status":"published","title":"Loofah allowed_uri? treats data:text/html as safe text/plain","updatedAt":1794517746230}