CVE-2026-126208

The Loofah library, used for HTML/XML manipulation, contains a vulnerability in versions prior to 2.25.3 due to an incorrect SVG_ALLOW_LOCAL_HREF safelist. Specifically, the library uses a lowercase spelling for textPath that does not match the HTML5 parser and omits mpath, allowing external href...