These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
Loofah is vulnerable to a URI scheme bypass issue due to Loofah::HTML5::Scrub.allowed_uri? not properly rejecting javascript: or vbscript: URIs when the scheme is split by semicolon-less numeric character references. This issue affects callers passing HTML-encoded strings directly to allowed_uri?, potentially allowing attackers to execute arbitrary code. The issue is fixed in Loofah version 2.25.2. Defend [truncated]
CVE-2026-73491 is a vulnerability in the Loofah library, which is used for manipulating and transforming HTML/XML documents and fragments. The vulnerability affects versions 2.25.0 to 2.25.2 and allows for the execution of JavaScript code via HTML-encoded strings. The issue is fixed in version 2.25.2. Defenders should verify the version of Loofah used in their applications and upgrade to version 2.25.2 or [truncated]
CVE-2026-73490 is a vulnerability in the Loofah library, which is used for manipulating and transforming HTML/XML documents and fragments. The vulnerability allows a crafted sanitized SVG to reference an arbitrary same-origin external document, potentially leading to the rendering of external SVG content containing scripts or other dangerous content.