GHSA-9wjq-cp2p-hrgf: Loofah: SVG `href` attribute bypasses local-reference restriction

July 21, 2026 (updated August 12, 2026)

Loofah’s HTML5 sanitizer restricted only the xlink:href attribute on certain SVG elements to local, same-document references. Browsers also accept a plain href attribute as an alternative to the deprecated xlink:href per the SVG 2 spec, but Loofah did not apply the same restriction to it, allowing those elements to reference arbitrary external documents.

References

github.com/advisories/GHSA-9wjq-cp2p-hrgf
github.com/flavorjones/loofah/commit/20867b9be689521887364b74822c41ef830523c9
github.com/flavorjones/loofah/releases/tag/v2.25.2
github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf
nvd.nist.gov/vuln/detail/CVE-2026-73490

Code Behaviors & Features

Detect and mitigate GHSA-9wjq-cp2p-hrgf with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →