Linux Distros Unpatched Vulnerability : CVE-2026-73492

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2,...

DEBIAN-CVE-2026-73492

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references...

UBUNTU-CVE-2026-73492

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references...

CVE-2026-73492

Loofah (Ruby, Nokogiri-based) versions 2.25.0–2.25.2 expose a vulnerability in Loofah::HTML5::Scrub.allowed_uri?, where javascript: or vbscript: URIs split by semicolon-less numeric character references (e.g., &#58, &#9, &#10, &#13) are not rejected. CGI.unescapeHTML leaves these references encod...