CVE-2026-126209

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.3, Loofah::HTML5::Scrub.alloweduri? strips whitespace and control characters before decoding a semicolon-less numeric character reference, changing wher...