CVE-2026-126207

The Loofah library, used for manipulating HTML/XML documents, is vulnerable to a CSS url() sanitization bypass in versions prior to 2.25.3 . The root cause lies in Loofah::HTML5::Scrub.scrub_css, which only validates the first parse of a style attribute. Attackers can use escaped parentheses (e.g...