AIKIDO-2026-622262

loofah is vulnerable to Cross-site Scripting (XSS)

Cross-site Scripting (XSS)GHSA-9wjq-cp2p-hrgf Published Jul 16, 2026

Medium Risk

This Affects:

loofah

0.0.1 - 2.25.1

Fixed in 2.25.2

Are you affected? Scan for Free

TL;DR

Affected versions of loofah are vulnerable to Cross-site Scripting (XSS) because the HTML5 sanitizer only restricted the xlink:href attribute on certain SVG elements to local, same-document references. Browsers also accept a plain href attribute as an SVG 2 alternative, but Loofah did not apply the same restriction, allowing elements such as <use> and <feImage> to reference arbitrary external documents. That can lead to rendering external SVG content (including scripts in same-origin cases) or loading external images for tracking when user-supplied SVG is sanitized with the default allowlist.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application sanitizes user-supplied SVG (directly or as part of HTML) with Loofah's default allowlist.