Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction

Summary Loofah restricts href and xlink:href on certain SVG elements to same-document references. Two elements escaped the restriction: - : SVGALLOWLOCALHREF listed it in lowercase as textpath, but the HTML5 parser names the element textPath inside , so the check never matched on the HTML5 path. ...

GHSA-345X-3RQ2-JFRM Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction

Summary Loofah restricts href and xlink:href on certain SVG elements to same-document references. Two elements escaped the restriction: - : SVGALLOWLOCALHREF listed it in lowercase as textpath, but the HTML5 parser names the element textPath inside , so the check never matched on the HTML5 path. ...

CVE-2026-126208 Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVGALLOWLOCALHREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external hr...

CVE-2026-126208

The Loofah library, used for HTML/XML manipulation, contains a vulnerability in versions prior to 2.25.3 due to an incorrect SVG_ALLOW_LOCAL_HREF safelist. Specifically, the library uses a lowercase spelling for textPath that does not match the HTML5 parser and omits mpath, allowing external href...

Mozilla Firefox textPath Element Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mozilla Firefox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...