CVE-2026-73490 flavorjones CVE debrief

Who should care

Developers and administrators using the Loofah library to sanitize user-supplied SVG content should be aware of this vulnerability and take steps to update to version 2.25.2 or later.

Why it matters

CVE-2026-73490 is a medium-severity vulnerability in the Loofah library that allows crafted sanitized SVG to reference arbitrary same-origin external documents. Developers and administrators should update to version 2.25.2 or later and exercise caution when sanitizing user-supplied SVG content.

• Potential rendering of external SVG content containing scripts or other dangerous content
• Possible loading of external images for tracking

Technical summary

The Loofah library's HTML5 sanitizer does not properly restrict references to external documents in SVG files, allowing an attacker to craft a sanitized SVG that references an arbitrary same-origin external document. This issue arises because Loofah's sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept the plain href attribute. As a result, a crafted sanitized SVG can reference an arbitrary same-origin external document, potentially leading to the rendering of external SVG content containing scripts or other dangerous content, and feImage may load external images for tracking. Applications that sanitize user-supplied SVG

Defensive priority

Medium

Recommended defensive actions

• Review and update Loofah library to version 2.25.2 or later
• Sanitize user-supplied SVG with Loofah's default allowlist with caution
• Monitor for potential external SVG content rendering
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by Loofah's HTML5 sanitizer applying its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept the plain href attribute. This issue is fixed in version 2.25.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.