CVE-2026-126203

The Loofah library, specifically versions 2.21.0 through 2.25.3 , is vulnerable to a Mutation XSS vulnerability. The issue occurs when Loofah's HTML5 APIs (including Loofah.html5_fragment, Loofah.html5_document, and scrub_html5_* methods) are used with Nokogiri versions prior to 1.19.5 . Because ...

CVE-2026-126203 Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5fragment, Loofah.html5document, and the scrubhtml5 methods can emit sanitized output that a browser reparses as...

SUSE CVE-2026-126063

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application...

CVE-2026-126063

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application...

CVE-2026-126063

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application...

DEBIAN-CVE-2026-126063

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application...

Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer

Summary Nokogiri's HTML5 serializer did not escape text inside noscript elements, or inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation...

GHSA-4P39-36WJ-23H4 Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer

Summary Nokogiri's HTML5 serializer did not escape text inside noscript elements, or inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation...

CVE-2026-126063 Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application...

CVE-2026-126063 Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application...

CVE-2026-126063

The Nokogiri library (versions 1.12.0 to 1.19.5) contains a Mutation XSS vulnerability within its HTML5 serializer on the CRuby and TruffleRuby C extensions. The root cause is that the serializer fails to escape text inside noscript elements or angle brackets within attribute values. If an applic...

CVE-2026-126063

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application...

EUVD-2026-122832

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application...

CVE-2026-126063: sparklemotion nokogiri: Nokogiri is an open source XML and HTML library for the Ruby programming language

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application...

CLEANSTART-2026-ZZ72297 mutation XSS affects users calling bleach

CVE-2021-23980 affects multiple packages. A mutation XSS affects users calling bleach. See references for individual vulnerability details...

EUVD-2026-102241

ammonia: mXSS via MathML annotation-xml encoding strip...

SUSE CVE-2026-63430

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia...

Linux Distros Unpatched Vulnerability : CVE-2026-63430

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag,...

UBUNTU-CVE-2026-63430

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia...

CVE-2026-63430

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia...