CVE-2026-126203

The Loofah library, specifically versions 2.21.0 through 2.25.3 , is vulnerable to a Mutation XSS vulnerability. The issue occurs when Loofah's HTML5 APIs (including Loofah.html5_fragment, Loofah.html5_document, and scrub_html5_* methods) are used with Nokogiri versions prior to 1.19.5 . Because ...

CVE-2026-126203: flavorjones loofah: Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5fragment, Loofah.html5document, and the scrubhtml5 methods can emit sanitized output that a browser reparses as...