Vulnerability in loofah (CVE-2026-73491)
Summary
Vulnerability in loofah (CVE-2026-73491). Risk of unauthorized operations or information disclosure. Exploitable via CGI.unescapeHTML. Mitigation: upgrade to 2.25.2 or later.
Original description
The description as published by the source.
Summary
Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript: URIs when the scheme is split or prefixed by the HTML5 named character references 	 (tab) or 
 (line feed).
This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled the equivalent numeric character references (	, , ) but did not cover the named forms.
Details
allowed_uri? decodes HTML entities with CGI.unescapeHTML, which handles numeric character references but not HTML5 named character references. Payloads like java	script:alert(1) are therefore left intact, so the method does not recognize the javascript: scheme and returns true. A browser, however, decodes 	 and 
 to tab and line feed and strips them from the URL during parsing, producing javascript:alert(1).
	 and 
 are the only relevant named character references: across the HTML5 named-character table, they are the only two that decode to characters the WHATWG URL parser strips from a URL (U+0009 and U+000A; there is no named reference for U+000D). /   decode to U+00A0, which browsers do not strip, so they aren't usable for this bypass.
Note that Loofah's default sanitize() path is not affected, because Nokogiri decodes or entity-escapes HTML entities during parsing before Loofah evaluates the URI protocol. This issue on…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-73491 has been found in loofah.
Attackers can target a specific entry point like CGI.unescapeHTML over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade loofah to 2.25.2 or later.
If unsure, ask your IT team or search "loofah CVE-2026-73491" on the vendor's site.
CVE-2026-73491 (loofah) — CWE-184
Attack surface: CGI.unescapeHTML / true / href
Patched: 2.25.2 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-184) exists in loofah. Attackers reach the vulnerable code path via CGI.unescapeHTML.
Check the vendor advisory for the affected versions of loofah. Attack surface: CGI.unescapeHTML / true / href.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 2.25.2.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'loofah' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'loofah' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
loofahを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade loofah to 2.25.2ステージング環境で 2.25.2 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-73491 ruby-loofah
- Ubuntu UBUNTU-CVE-2026-73491 ruby-loofah