CVE-2026-126203 | flavorjones Loofah up to 2.25.2 HTML5 APIs HTML injection

A vulnerability classified as problematic has been found in flavorjones Loofah up to 2.25.2. This affects the function Loofah.html5_fragment/Loofah.html5_document/scrub_html5_* of the component HTML5 APIs. This manipulation causes HTML injection.

This vulnerability is tracked as CVE-2026-126203. The attack is possible to be carried out remotely. No exploit exists.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More