Bug 2572834 (CVE-2026-126208)

Summary:	CVE-2026-126208 loofah: loofah: Information disclosure via unsanitized SVG hyperlinks
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akostadi, amasferr, dmayorov, ehelms, eshamard, jlledo, jpasqual, juwatts, jvasik, kaycoth, lblicha, mhulan, ogajduse, osousa, pantinor, rblanco, rchan, smallamp, tsedmik, zhunting
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Loofah. A remote attacker can exploit this vulnerability by submitting specially crafted Scalable Vector Graphics (SVG) markup containing external hyperlinks that bypass sanitization. When a victim renders the content in a web browser, the browser initiates an unintended network request to an external server. This can lead to information disclosure, potentially leaking the user's IP address and browser metadata, or reaching internal network resources.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-12 21:11:21 UTC

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG_ALLOW_LOCAL_HREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's element name and omits mpath, so external href and xlink:href values on those elements survive sanitization. Firefox fetches the attacker-chosen URL when a viewer renders the content, which can disclose the viewer's IP address, user agent, referrer, and access to hosts routable only from the viewer's network. Chrome and WebKit do not fetch these references, and the impact is a network request rather than script execution. The rails-html-sanitizer PermitScrubber reuses the affected safelist when SVG elements are permitted. This issue is fixed in version 2.25.3.