CVE-2026-126207 (CVSS 4.7)

Description

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah::HTML5::Scrub.scrub_css checks only the first parse of a style attribute, then rebuilds CSS with identifier escapes decoded so escaped parentheses, property names, comments, or quotes can become a live url() without a second safety check. An attacker can use list-style to make a viewer's browser request an attacker-chosen URL when content renders, or cursor to make the request on hover. The request can disclose the viewer's IP address, user agent, access timing, and access to internal-network hosts, but no script survives sanitization and the attacker cannot read the response. This issue is fixed in version 2.25.3.

Is your site exposed to CVE-2026-126207?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.7

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Weakness Type (CWE)

CWE-180 CWE-180

CWE-184 CWE-184

References

Other References

https://github.com/flavorjones/loofah/commit/b198a36e44c9c5408163ac50787825e8ca0b166b https://github.com/flavorjones/loofah/pull/324 https://github.com/flavorjones/loofah/releases/tag/v2.25.3 https://github.com/flavorjones/loofah/security/advisories/GHSA-m3x9-938q-5767

Frequently Asked Questions

What is CVE-2026-126207? +

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah::HTML5::Scrub.scrub_css checks only the first parse of a style attribute, then rebuilds CSS with identifier escapes decoded so escaped parentheses, property names, comments, or quotes can become a live url() without a second safety check. An attacker can use list-style to make a viewer's browser request an attacker-chosen URL when content renders, or cursor to make the request on hover. The request can disclose the viewer's IP address, user agent, access timing, and access to internal-network hosts, but no script survives sanitization and the attacker cannot read the response. This issue is fixed in version 2.25.3. It has a CVSS v3.1 base score of 4.7 (MEDIUM).

How severe is CVE-2026-126207? +

CVE-2026-126207 has a CVSS v3.1 score of 4.7 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

How do I check if I'm vulnerable to CVE-2026-126207? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-110846

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before …

CVE-2025-29787

`zip` is a zip library for rust which supports reading and writing of simple ZIP files. In the archive extraction …

CVE-2026-45022

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed …

CVE-2026-93326

A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious …

CVE-2026-105050

PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because …

CVE-2026-82481

The cohttp package before 6.3.0 for OCaml allows directory traversal.