Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values

Summary Loofah's HTML5 scrubbers could emit output that a browser parses into different markup, allowing mutation XSS. Nokogiri in attribute values. When the output contained certain MathML, a browser treated markup inside an allowed attribute as live HTML. The :strip scrubber is affected in ever...

CVE-2026-126203

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5fragment, Loofah.html5document, and the scrubhtml5 methods can emit sanitized output that a browser reparses as...

CVE-2026-126203

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5fragment, Loofah.html5document, and the scrubhtml5 methods can emit sanitized output that a browser reparses as...

CVE-2026-126203 Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5fragment, Loofah.html5document, and the scrubhtml5 methods can emit sanitized output that a browser reparses as...

PT-2026-146000

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5 fragment, Loofah.html5 document, and the scrub html5 methods can emit sanitized output that a browser reparses as...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

CentOS Linux 7 [TuxCare] Security Update: python-lxml / python-lxml-docs (CENTOS7:CLSA-2026:1792861994)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1792861994 advisory. - lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missing...

GHSA-9JH8-V38H-CVHR ammonia: mXSS via MathML `annotation-xml` encoding strip

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser. The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the...

ammonia: mXSS via MathML `annotation-xml` encoding strip

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser. The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the...

Alibaba Cloud Linux 3 : 0309: python-lxml (ALINUX3-SA-2026:0309)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0309 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-49825: lxml is a library for processing XM...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

CVE-2026-63430

A flaw was found in ammonia. This vulnerability allows a remote attacker to conduct cross-site scripting XSS by submitting specially crafted markup to an application configured to permit specific Mathematical Markup Language MathML tags and raw-text elements. Because ammonia does not correctly...

CVE-2026-63430

The ammonia Rust library, used for securing untrusted HTML, is vulnerable to mutation cross-site scripting (mXSS) prior to versions 3.3.2, 4.0.2, and 4.1.3 . The root cause is the incorrect handling of the annotation-xml tag during attribute filtering. When the math and annotation-xml tags are en...

CVE-2026-63430 ammonia: mXSS in ammonia via MathML `annotation-xml` encoding strip

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia...

CVE-2026-63430 ammonia: mXSS in ammonia via MathML `annotation-xml` encoding strip

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia...

CVE-2026-63430 ammonia: mXSS in ammonia via MathML `annotation-xml` encoding strip

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia...

Ammonia HTML Sanitizer – Ammonia Cross-Site Script Vulnerability

Ammonia HTML Sanitizer versions prior to 3.3.2, 4.0.2, and 4.1.3 have a cross-site scripting vulnerability. This vulnerability stems from improper implementation of the encoding-related MathML integration point in annotation-xml. After the attribute filtering removes the encoding, inconsistent...

EulerOS 2.0 SP13 : python-lxml (EulerOS-SA-2026-4095)

According to the versions of the python-lxml packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missin...