CVE-2026-126208

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVGALLOWLOCALHREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external hr...

CVE-2026-126205

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, the Loofah HTML5 sanitizer checks href and xlink:href on elements in SVGALLOWLOCALHREF with a regular expression whose line anchor and newline-matching...

CVE-2026-126208: flavorjones loofah: Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVGALLOWLOCALHREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external hr...