835 matches found
sanitize
Sanitize Sanitize is an allowlist-based HTML and CSS sanitizer. It removes all HTML and/or CSS from a string except the elements, attributes, and properties you choose to allow. Using a simple configuration syntax, you can tell Sanitize to allow certain HTML elements, certain attributes within...
Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction
Summary Loofah restricts href and xlink:href on certain SVG elements to same-document references. Two elements escaped the restriction: - : SVGALLOWLOCALHREF listed it in lowercase as textpath, but the HTML5 parser names the element textPath inside , so the check never matched on the HTML5 path. ...
GHSA-345X-3RQ2-JFRM Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction
Summary Loofah restricts href and xlink:href on certain SVG elements to same-document references. Two elements escaped the restriction: - : SVGALLOWLOCALHREF listed it in lowercase as textpath, but the HTML5 parser names the element textPath inside , so the check never matched on the HTML5 path. ...
GHSA-P9WJ-W8XQ-VJX6 Loofah allowed_uri? treats javascript: alert(1) as safe
Summary Loofah::HTML5::Scrub.alloweduri? returns true for a javascript: or vbscript: URI whose scheme is split by a numeric character reference without a trailing semicolon, followed by a character that alloweduri? strips, such as a space or tab. A browser ends the reference at that character and...
CVE-2026-126209
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.3, Loofah::HTML5::Scrub.alloweduri? strips whitespace and control characters before decoding a semicolon-less numeric character reference, changing wher...
CVE-2026-126209
The Loofah library (versions 2.25.0 through 2.25.3 ) contains a vulnerability in the Loofah::HTML5::Scrub.allowed_uri? helper. The root cause is that the helper strips whitespace and control characters before decoding semicolon-less numeric character references. This allows an attacker to termina...
CVE-2026-126209 Loofah allowed_uri? treats javascript: alert(1) as safe
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.3, Loofah::HTML5::Scrub.alloweduri? strips whitespace and control characters before decoding a semicolon-less numeric character reference, changing wher...
CVE-2026-126208
The Loofah library, used for HTML/XML manipulation, contains a vulnerability in versions prior to 2.25.3 due to an incorrect SVG_ALLOW_LOCAL_HREF safelist. Specifically, the library uses a lowercase spelling for textPath that does not match the HTML5 parser and omits mpath, allowing external href...
CVE-2026-126206
The Loofah library (version 2.25.2 ) contains a vulnerability in the Loofah::HTML5::Scrub.allowed_uri? helper. The issue arises because the helper fails to decode the HTML5 named character reference / , causing it to treat a data URI with a mediatype like data:text/html as malformed and f...
CVE-2026-126206 Loofah allowed_uri? treats data:text/html as safe text/plain
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.alloweduri? treats a data URI mediatype containing the HTML5 named solidus reference as malformed and falls back to the allowed text/plain, whi...
java-html-sanitizer
OWASP Java HTML Sanitizer A fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS. The sanitizer JAR has no runtime dependencies. Its only compile-time dependency is spotbugs-annotations...
HTMLawed
HTMLawed is ... ... a single-file, 45 kb PHP script that makes input text more secure, HTML standards-compliant, and suitable in general from the viewpoint of a web-page administrator, for use in the body of HTML, XHTML or XML documents. A simple HTMLTidy alternative, the htmLawed filter,...
OWASPBugBounty
OWASP Bug Bounty for Projects Introduction Many developers and companies looking to implement security are turning towards OWASP to use Defender libraries that they can implement to secure their critical applications. Since this implies a form of trust in OWASP, many users of these projects might...
PT-2026-146055
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG ALLOW LOCAL HREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external...
PT-2026-146059
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.3, Loofah::HTML5::Scrub.allowed uri? strips whitespace and control characters before decoding a semicolon-less numeric character reference, changing whe...
CVE-2026-126209: flavorjones loofah: Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.3, Loofah::HTML5::Scrub.alloweduri? strips whitespace and control characters before decoding a semicolon-less numeric character reference, changing wher...
CVE-2026-126208: flavorjones loofah: Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVGALLOWLOCALHREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external hr...
PT-2026-146053
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.allowed uri? treats a data URI mediatype containing the HTML5 named solidus reference as malformed and falls back to the allowed text/plain,...
TYPO3-HTML-Sanitizer-XSS-CVE-2023-47125
Stored XSS exploit in TYPO3 HTML Sanitizer CVE-2023-47125 Description DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. Vuln versions = 1.0.0, = 2.0.0,...
bleach
====== Bleach NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues. See issue: Bleach is an allowed-list-based HTML sanitizing library that escapes or strips markup and attributes. Bleach can also linkify text safely, applying filters th...