CVE-2026-73491

RubyGems/loofah CVE-2026-73491: low, EPSS 0.39%

Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

Action: Upgrade loofah to 2.25.2 or later.

bundle update loofah

Affected

Fixed versions

Sources

• osv: GHSA-8whx-365g-h9vv
• https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv
• https://github.com/flavorjones/loofah/commit/5e91af861e3cdab47b91dd0b81f3afdfd13a5e19
• https://github.com/flavorjones/loofah
• https://github.com/flavorjones/loofah/releases/tag/v2.25.2

CVE-2026-73491 · published 2026-07-21T15:04:14Z · modified 2026-09-10T03:51:11.109228326Z · JSON