{"affected":[{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-9wjq-cp2p-hrgf/GHSA-9wjq-cp2p-hrgf.json"},"package":{"ecosystem":"RubyGems","name":"loofah","purl":"pkg:gem/loofah"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.25.2"}],"type":"ECOSYSTEM"}],"versions":["0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","1.0.0","1.0.0.beta.1","1.1.0","1.2.0","1.2.1","2.0.0","2.0.1","2.0.2","2.0.3","2.1.0","2.1.0.rc1","2.1.0.rc2","2.1.1","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.15.0","2.16.0","2.17.0","2.18.0","2.19.0","2.19.1","2.2.0","2.2.1","2.2.2","2.2.3","2.20.0","2.21.0","2.21.0.rc1","2.21.1","2.21.2","2.21.3","2.21.4","2.22.0","2.23.0","2.23.1","2.24.0","2.24.1","2.25.0","2.25.1","2.3.0","2.3.1","2.4.0","2.5.0","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1"]}],"aliases":["CVE-2026-73490"],"database_specific":{"cwe_ids":["CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-07-21T22:01:58Z","nvd_published_at":null,"severity":"MODERATE"},"details":"## Summary\n\nLoofah's HTML5 sanitizer restricted only the `xlink:href` attribute on certain SVG elements to local, same-document references. Browsers also accept a plain `href` attribute as an alternative to the deprecated `xlink:href` per the SVG 2 spec, but Loofah did not apply the same restriction to it, allowing those elements to reference arbitrary external documents.\n\n## Impact\n\nSVG `<use>` can load and render external SVG content by reference. If the referenced external SVG is same-origin and contains scripts or other dangerous content, it could execute in the context of the sanitized document. `<feImage>` can load external images, which can be used for tracking. Modern browsers restrict cross-origin `<use>` fetches, which limits but does not eliminate the risk.\n\nApplications that sanitize user-supplied SVG (directly, or as part of HTML) with Loofah's default allowlist are affected.\n\n## Mitigation\n\nUpgrade to Loofah >= 2.25.2.\n\n## Credit\n\nFound by the maintainer, Mike Dalessio, during a security audit.","id":"GHSA-9wjq-cp2p-hrgf","modified":"2026-09-10T03:51:11.411106078Z","published":"2026-07-21T22:01:58Z","references":[{"type":"WEB","url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/commit/20867b9be689521887364b74822c41ef830523c9"},{"type":"PACKAGE","url":"https://github.com/flavorjones/loofah"},{"type":"WEB","url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.2"}],"schema_version":"1.9.0","severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","type":"CVSS_V3"}],"summary":"Loofah: SVG `href` attribute bypasses local-reference restriction"}