{"uuid": "5ded911c-f270-46d6-87e7-20eeab30f997", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-9wjq-cp2p-hrgf", "type": "seen", "source": "https://gist.github.com/alon710/cd896a69a4be919308bb443d6cb706e0", "content": "# GHSA-9WJQ-CP2P-HRGF: GHSA-9WJQ-CP2P-HRGF: SVG href Attribute Bypass in Loofah HTML/XML Sanitizer\n\n> **CVSS Score:** 4.7\n> **Published:** 2026-07-21\n> **Full Report:** https://cvereports.com/reports/GHSA-9WJQ-CP2P-HRGF\n\n## Summary\nA security logic flaw in Loofah, a Ruby HTML/XML sanitization library, allowed unauthenticated attackers to bypass local-reference restrictions on SVG elements. Prior to version 2.25.2, Loofah only sanitized the legacy namespaced \"xlink:href\" attribute when enforcing local URI fragments on SVG elements like \"\". It did not validate or sanitize the plain, non-namespaced \"href\" attribute introduced in the SVG 2 standard. This structural omission allowed attackers to construct SVG elements referencing external domains, paving the way for arbitrary resource loading and cross-site scripting (XSS).\n\n## TL;DR\nLoofah fails to sanitize the SVG 2 plain 'href' attribute, enabling attackers to bypass local-reference restrictions and inject external resources or trigger Cross-Site Scripting.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 4.7 (Medium)\n- **EPSS Score**: Not Applicable\n- **Impact**: Cross-Site Scripting (XSS) / Resource Injection\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Loofah Ruby Gem\n- **loofah**: < 2.25.2 (Fixed in: `2.25.2`)\n\n## Mitigation\n\n- Upgrade the Loofah gem dependency to version 2.25.2 or higher.\n- Implement a robust Content Security Policy (CSP) with restrictive 'object-src' and 'img-src' directives.\n- Deploy web application firewall (WAF) signatures to intercept incoming payloads containing plain SVG href attributes pointing to external resources.\n\n**Remediation Steps:**\n1. Open your application Gemfile and update the loofah dependency line: gem 'loofah', '>= 2.25.2'\n2. Execute the command 'bundle update loofah' to fetch and apply the updated package.\n3. Run automated tests to confirm that SVG parsing continues to operate correctly while blocking non-local resources.\n4. Inspect Gemfile.lock to ensure that no indirect dependencies are pinning Loofah to a version below 2.25.2.\n\n## References\n\n- [GitHub Advisory Database entry](https://github.com/advisories/GHSA-9WJQ-CP2P-HRGF)\n- [Loofah Repository Security Advisory page](https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf)\n- [Patch Commit Link](https://github.com/flavorjones/loofah/commit/20867b9be689521887364b74822c41ef830523c9)\n- [Loofah v2.25.2 Release Notes](https://github.com/flavorjones/loofah/releases/tag/v2.25.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-9WJQ-CP2P-HRGF) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-22T08:30:36.450398Z"}