CVE-2026-126209 | flavorjones Loofah up to 2.25.2 URI Scrubbing Scrub.allowed_uri cross site scripting

November 12, 2026 Yanac

A vulnerability identified as problematic has been detected in flavorjones Loofah up to 2.25.2. This affects the function Loofah::HTML5::Scrub.allowed_uri of the component URI Scrubbing. This manipulation causes cross site scripting.

This vulnerability appears as CVE-2026-126209. The attack may be initiated remotely. There is no available exploit.

You should upgrade the affected component.VulDB Recent EntriesRead More