CVE-2026-126207 | flavorjones Loofah up to 2.25.2 CSS Scrubber Scrub.scrub_css escape output

November 12, 2026 Yanac

A vulnerability, which was classified as problematic, was found in flavorjones Loofah up to 2.25.2. Affected by this issue is the function Loofah::HTML5::Scrub.scrub_css of the component CSS Scrubber. The manipulation results in escaping of output.

This vulnerability is identified as CVE-2026-126207. The attack can be executed remotely. There is not any exploit available.

You should upgrade the affected component.VulDB Recent EntriesRead More