{"apiVersion":"1.0","identifier":"CVE-2026-73490","description":"Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah-s HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept the plain href attribute. A crafted sanitized SVG can therefore reference an arbitrary same-origin external document; use may render external SVG content containing scripts or other dangerous content, and feImage may load external images for tracking. Applications that sanitize user-supplied SVG with Loofah-s default allowlist are affected. This issue is fixed in version 2.25.2.","publishedAt":"2026-08-12T21:17:42","lastModifiedAt":"2026-08-13T13:19:18","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73490","cvssScore":4.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","epssProbability":0.0018,"riskScore":0.48,"affectedProduct":"Loofah","affectedVersions":"<2.25.2","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-73490","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-73490","en":"https://www.redsauce.net/en/cves/CVE-2026-73490","fr":"https://www.redsauce.net/fr/cves/CVE-2026-73490","pt":"https://www.redsauce.net/pt/cves/CVE-2026-73490","de":"https://www.redsauce.net/de/cves/CVE-2026-73490","sk":"https://www.redsauce.net/sk/cves/CVE-2026-73490","el":"https://www.redsauce.net/el/cves/CVE-2026-73490"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-73490"}}