{"affected":[{"product":"loofah","source":"CNA: GitHub_M","vendor":"flavorjones","versions":[{"status":"affected","version":"< 2.25.3"}]}],"cveId":"CVE-2026-126207","cwes":["CWE-180","CWE-184"],"description":"Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah::HTML5::Scrub.scrub_css checks only the first parse of a style attribute, then rebuilds CSS with identifier escapes decoded so escaped parentheses, property names, comments, or quotes can become a live url() without a second safety check. An attacker can use list-style to make a viewer's browser request an attacker-chosen URL when content renders, or cursor to make the request on hover. The request can disclose the viewer's IP address, user agent, access timing, and access to internal-network hosts, but no script survives sanitization and the attacker cannot read the response. This issue is fixed in version 2.25.3.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":4.7,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1794516835553,"publishedAt":1794516835553,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-m3x9-938q-5767"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/flavorjones/loofah/pull/324"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/flavorjones/loofah/commit/b198a36e44c9c5408163ac50787825e8ca0b166b"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"}],"remediation":[],"revision":"ce32fceaa44b7b7d4d7cbe2376709a9df89e0dd7a2e8ac5b2f5947e770052035","sources":[{"modifiedAt":1794516835553,"name":"CNA: GitHub_M","retrievedAt":1794517746685,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126207"}],"ssvc":null,"status":"published","title":"Loofah: CSS url() sanitization bypass via escaped parentheses","updatedAt":1794517746685}