CVE-2026-73491 flavorjones CVE debrief

Who should care

Defenders who use the Loofah library in their applications should verify the version used and upgrade to version 2.25.2 or later if necessary. This includes reviewing code that uses the allowed_uri? method and verifying the version of Loofah used in their applications. Defenders should also prioritize verifying the version of Loofah used in their applications and upgrading to version 2.25.2 or later if necessary.

Why it matters

CVE-2026-73491 is a vulnerability in the Loofah library that allows for the execution of JavaScript code via HTML-encoded strings. Defenders should prioritize verifying the version of Loofah used in their applications and upgrading to version 2.25.2 or later if necessary.

• Verify Loofah library version used in applications
• Upgrade to version 2.25.2 or later if necessary
• Review code that uses the allowed_uri? method

Technical summary

The Loofah library vulnerability allows for the execution of JavaScript code via HTML-encoded strings. The issue affects versions 2.25.0 to 2.25.2 and is fixed in version 2.25.2. The vulnerability is caused by the allowed_uri? method not rejecting javascript: URIs whose scheme is split or prefixed with HTML5 named whitespace character references. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?. Loofah's default sanitize() path is not affected. Defenders should prioritize verifying the version of Loofah used in their applications and upgrading to version 2.25.2 or later if necessary.

Defensive priority

Defenders should prioritize verifying the version of Loofah used in their applications and upgrading to version 2.25.2 or later if necessary.

Recommended defensive actions

• Verify the version of Loofah used in your application
• Upgrade to version 2.25.2 or later if necessary
• Review code that uses the allowed_uri? method
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The vulnerability is caused by the allowed_uri? method not rejecting javascript: URIs whose scheme is split or prefixed with HTML5 named whitespace character references. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?. The issue is fixed in version 2.25.2. Loofah's default sanitize() path is not affected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.