CVE-2026-126209

The Loofah library (versions 2.25.0 through 2.25.3 ) contains a vulnerability in the Loofah::HTML5::Scrub.allowed_uri? helper. The root cause is that the helper strips whitespace and control characters before decoding semicolon-less numeric character references. This allows an attacker to termina...