CVE-2026-73490

A flaw was found in Loofah. The HTML5 sanitizer incorrectly applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept the plain href attribute. A remote attacker could exploit this by crafting a sanitized SVG that referenc...