Is CVE-2026-126208 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126208 being exploited in the wild.

How severe is CVE-2026-126208?

Medium severity, with a CVSS score of 4.7, published 12 November 2026.

Which products and versions are affected?

Flavorjones Loofah before 2.25.3; loofah (RubyGems) < 2.25.3.

Is there a fix for CVE-2026-126208?

Yes: fixed in 2.25.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126208 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126208?

Check whether you run Flavorjones Loofah or loofah (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126208: Loofah SVG href sanitization bypass in textPath and mpath

Q: Is there a fix for CVE-2026-126208?

Yes: fixed in 2.25.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126208 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-126208?

Check whether you run Flavorjones Loofah or loofah (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126208 · Severity: medium · CVSS 4.7 · Published 2026-11-12

Loofah is a Ruby library that sanitizes HTML and XML content to prevent malicious code. A flaw in its SVG element safelist allows external URLs in textPath and mpath elements to bypass sanitization. When users view HTML containing these malicious elements in Firefox, their browser fetches the attacker-controlled URL, which can leak their IP address, user agent, and network information.

Technologies: Flavorjones Loofah, loofah (RubyGems). Vendors: Flavorjones, RubyGems.

Quick answers

Is CVE-2026-126208 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126208 being exploited in the wild.
How severe is CVE-2026-126208?: Medium severity, with a CVSS score of 4.7, published 12 November 2026.
Which products and versions are affected?: Flavorjones Loofah before 2.25.3; loofah (RubyGems) < 2.25.3.
Is there a fix for CVE-2026-126208?: Yes: fixed in 2.25.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126208 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126208?: Check whether you run Flavorjones Loofah or loofah (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.25.3

Technical details

The SVG_ALLOW_LOCAL_HREF safelist contained a spelling error (lowercase "textpath" instead of camelCase "textPath") that prevented it from matching the HTML5 parser's element name, and completely omitted "mpath". This allows external href and xlink:href attributes on these elements to survive sanitization. Firefox automatically fetches these external references, enabling information disclosure via forced network requests. The rails-html-sanitizer library's PermitScrubber inherits the affected safelist when SVG elements are permitted.

Affected products

flavorjones Loofah before 2.25.3

Identifiers

CVE-2026-126208
GHSA-345x-3rq2-jfrm

Timeline

2026-11-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.