Description

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept the plain href attribute. A crafted sanitized SVG can therefore reference an arbitrary same-origin external document; use may render external SVG content containing scripts or other dangerous content, and feImage may load external images for tracking. Applications that sanitize user-supplied SVG with Loofah's default allowlist are affected. This issue is fixed in version 2.25.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-12T21:17:42.127Z",
  "pubdate": "2026-08-12T21:17:42.127Z",
  "executiveSummary": "Loofah prior to version 2.25.2 suffers from an HTML5 sanitizer restriction bypass vulnerability affecting SVG processing. The vulnerability stems from the sanitization engine applying local-reference restrictions strictly to the xlink:href attribute on SVG use and feImage elements, while modern web browsers additionally accept and process the plain href attribute. Consequently, an attacker can supply crafted sanitized SVG markup that bypasses current filtering mechanisms to reference arbitrary same-origin external documents. The potential impact includes the rendering of external SVG content capable of executing malicious scripts or unauthorized code execution within the context of the victim's session, as well as the unauthorized loading of external images for user tracking and reconnaissance. Applications that process and sanitize user-supplied SVG content utilizing Loofah's default allowlist are directly affected. Exploitation requires an attacker to supply malicious SVG payloads that are subsequently rendered by vulnerable applications, leveraging the discrepancy between sanitizer restrictions and browser attribute parsing capabilities to achieve unauthorized external content inclusion.",
  "technicalDetails": "The root cause of this vulnerability lies in an incomplete attribute restriction implementation within Loofah's HTML5 sanitizer when parsing Scalable Vector Graphics (SVG) elements. Specifically, the sanitizer restricts local-reference mechanisms exclusively on the deprecated xlink:href attribute found within SVG use and feImage elements. Modern HTML5-compliant web browsers also natively support and process the standard plain href attribute on these exact same elements for identical referencing functionality. Because the Loofah sanitizer fails to account for or sanitize the plain href attribute in this context, crafted payloads evade the security boundaries enforced by the default allowlist.\nThe exploitation method relies on supplying malicious SVG markup containing elements such as use or feImage configured with the unrestricted plain href attribute pointing to an arbitrary same-origin external document or resource. When a vulnerable application sanitizes the input using affected versions of Loofah prior to 2.25.2 and subsequently renders the output to a client browser, the sanitization mechanism permits the plain href attribute to pass through unmodified.\nThe step-by-step attack flow proceeds as follows: First, an unauthenticated attacker crafts an SVG payload utilizing the plain href attribute on a use or feImage element to target a specific same-origin external resource or document. Second, the attacker submits this malicious input to a vulnerable web application that utilizes Loofah to sanitize user-supplied HTML and SVG content. Third, the Loofah sanitizer evaluates the input against its default allowlist, fails to identify the plain href attribute as a security risk due to incomplete validation rules, and retains the attribute in the sanitized output. Fourth, the application stores or renders the resulting sanitized SVG document to the end user. Finally, when the victim's browser parses and renders the SVG, it resolves the plain href attribute, successfully fetching and integrating the external resource. If the referenced resource is an external SVG containing scripts or other dangerous content, those scripts execute in the victim's browser session. Alternatively, if feImage is utilized, it forces the loading of external images, facilitating user tracking and potential reconnaissance.\nThe vulnerable component is the HTML5 sanitizer functionality implemented within the Loofah library, specifically affecting versions prior to 2.25.2. No authentication or elevated privileges are strictly required by the attacker beyond the ability to supply input that is processed and rendered by the application's sanitization pipeline. The network exposure is dictated by the application architecture exposing input vectors that accept and render user-supplied SVG content."
}