Loofah: CSS url() sanitization bypass via escaped parentheses
CVE-2026-126207
Summary Loofah::HTML5::Scrub.scrubcss rejected any property whose top-level Crass tokens included a :url or :badurl, and left url out of the allowed CSS functions. Both checks ran only against the first parse of the style attribute. When scrubcss rebuilt each property it emitted identifiers with their CSS escapes decoded, so parentheses written as escapes — url\28 …\29 — hid the url token from the checks, and the rebuilt value was re-parsed into a live url() that nothing checked again. An escaped property name, six-digit escapes, escaped comments and escaped quotes all reached the same place. Impact A sanitized style attribute could make a viewer's browser issue a request to an attacker-chosen URL. list-style fetches on render with no interaction, cursor on hover. That leaks the viewer's IP address, user agent and access timing, and can reach hosts routable only from the viewer's network. No script survives sanitization and the attacker cannot read the response, so the request itself is the whole impact. Applications that sanitize user-supplied HTML with Loofah's default allowlist and display it to other people are affected. Mitigation Upgrade to Loofah >= 2.25.3. Credit Reported…
Assessment
- CVSS
- 4.7 (v3.1)
- Severity
- Medium
- EPSS
- 0% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 12 November 2026
- Last updated
- 13 November 2026
- Affected
- flavorjones · loofah · loofah
- Weakness
- CWE-180, CWE-184
- Assigner
- GitHub_M
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
At the source
References
- https://github.com/flavorjones/loofah/security/advisories/GHSA-m3x9-938q-5767
- https://github.com/flavorjones/loofah/pull/324
- https://github.com/flavorjones/loofah/commit/b198a36e44c9c5408163ac50787825e8ca0b166b
- https://github.com/flavorjones/loofah/releases/tag/v2.25.3
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/GHSA-m3x9-938q-5767.yml
- https://github.com/advisories/GHSA-m3x9-938q-5767
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-126207