Loofah allowed_uri? treats data:text/html as safe text/plain
CVE-2026-126206
Summary Loofah::HTML5::Scrub.alloweduri? returns true for a data: URI whose mediatype is written with the HTML5 named character reference / in place of the solidus. Loofah reads that mediatype as malformed and falls back to the allowed text/plain, while a browser decodes the reference and reads the same URI as text/html. Details alloweduri? decodes HTML entities with CGI.unescapeHTML, which handles numeric character references but not HTML5 named character references. / therefore survives normalization, so the mediatype carries no /, fails the MIME grammar, and falls back to the allowed text/plain under the WHATWG rule for a malformed mediatype. :, /, 	 and 
 are the only named character references in the HTML5 table that decode to characters that change how a URI parses (U+003A, U+002F, U+0009 and U+000A; there is no named reference for U+000D), so this closes the set. Loofah's default sanitize() path is not affected, because Nokogiri decodes the entity during parsing before Loofah evaluates the URI. This issue affects only callers of the public alloweduri? string-level helper that pass it HTML-encoded strings. Impact Applications that validate a…
Assessment
- CVSS
- 5.3 (v4.0)
- Severity
- Medium
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 12 November 2026
- Last updated
- 12 November 2026
- Affected
- loofah
- Weakness
- CWE-184, CWE-79
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
At the source
References
- https://github.com/flavorjones/loofah/security/advisories/GHSA-jcff-cj73-4w4f
- https://github.com/flavorjones/loofah/pull/324
- https://github.com/flavorjones/loofah/commit/ad92002966053309f83b550861e2ef04bc714744
- https://github.com/flavorjones/loofah/releases/tag/v2.25.3
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/GHSA-jcff-cj73-4w4f.yml
- https://github.com/advisories/GHSA-jcff-cj73-4w4f
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-126206