Is CVE-2026-126203 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126203 being exploited in the wild.

How severe is CVE-2026-126203?

Medium severity, with a CVSS score of 6.1, published 12 November 2026.

Which products and versions are affected?

Loofah 2.21.0 to 2.25.2; loofah (RubyGems) >= 2.21.0, < 2.25.3; Sparkling Motion Nokogiri before 1.19.5.

Is there a fix for CVE-2026-126203?

Yes: fixed in Loofah 2.25.3. Until then: Upgrade Loofah to version 2.25.3, which now requires Nokogiri >= 1.19.5 that properly escapes angle brackets in attribute values. [ { "kind": "disclosed", "at": "2026-11-12" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126203 attacked?

It is attacked over the network.

Am I affected by CVE-2026-126203?

Check whether you run Loofah, loofah (RubyGems) or Sparkling Motion Nokogiri at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126203: Loofah HTML5 scrubber markup injection with Nokogiri

Q: Is there a fix for CVE-2026-126203?

Yes: fixed in Loofah 2.25.3. Until then: Upgrade Loofah to version 2.25.3, which now requires Nokogiri >= 1.19.5 that properly escapes angle brackets in attribute values. [ { "kind": "disclosed", "at": "2026-11-12" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-126203 · Severity: medium · CVSS 6.1 · Published 2026-11-12

Loofah is a library that sanitizes HTML and XML documents. When used with older versions of Nokogiri, its HTML5 scrubbing functions can output HTML that a browser reinterprets as executable markup, allowing attackers to bypass sanitization. This could enable cross-site scripting (XSS) attacks on applications using affected versions.

Technologies: Loofah, loofah (RubyGems). Vendors: Loofah, RubyGems.

Quick answers

Is CVE-2026-126203 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126203 being exploited in the wild.
How severe is CVE-2026-126203?: Medium severity, with a CVSS score of 6.1, published 12 November 2026.
Which products and versions are affected?: Loofah 2.21.0 to 2.25.2; loofah (RubyGems) >= 2.21.0, < 2.25.3; Sparkling Motion Nokogiri before 1.19.5.
Is there a fix for CVE-2026-126203?: Yes: fixed in Loofah 2.25.3. Until then: Upgrade Loofah to version 2.25.3, which now requires Nokogiri >= 1.19.5 that properly escapes angle brackets in attribute values.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-11-12" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126203 attacked?: It is attacked over the network.
Am I affected by CVE-2026-126203?: Check whether you run Loofah, loofah (RubyGems) or Sparkling Motion Nokogiri at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Loofah 2.25.3

Upgrade Loofah to version 2.25.3, which now requires Nokogiri >= 1.19.5 that properly escapes angle brackets in attribute values.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-11-12" } ]

Technical details

The vulnerability is a mutation XSS (mXSS) affecting Loofah's HTML5 APIs (html5_fragment, html5_document, and scrub_html5_* methods) when combined with Nokogiri versions before 1.19.5. Nokogiri <1.19.5 fails to escape angle brackets (< and >) in HTML attribute values; MathML elements can exploit this to place markup inside allowed attributes, which browsers then reparse as live HTML. The :strip scrubber is affected in all browsers, while :prune and :escape are vulnerable in WebKit browsers only.

Affected products

Loofah Loofah 2.21.0 to 2.25.2
Sparkling Motion Nokogiri before 1.19.5

Identifiers

CVE-2026-126203
GHSA-h6v6-rg66-fqj4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.