CVE-2026-126206

A flaw was found in Loofah. This vulnerability allows cross-site scripting XSS because the library's address validation helper fails to properly handle HTML character references in data URIs Uniform Resource Identifiers. As a result, the helper incorrectly treats potentially harmful HTML content ...