Quick answers
- Is CVE-2026-126209 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-126209 being exploited in the wild.
- How severe is CVE-2026-126209?
- Medium severity, published 12 November 2026.
- Which products and versions are affected?
- Loofah 2.25.0 to 2.25.2; Rails-Html-Sanitizer affected versions; loofah (RubyGems) >= 2.25.0, < 2.25.3.
- Is there a fix for CVE-2026-126209?
- Yes: fixed in Loofah 2.25.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-126209 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-126209?
- Check whether you run Loofah, Rails-Html-Sanitizer or loofah (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Loofah 2.25.3
Technical details
The vulnerability exists in Loofah's allowed_uri? function (and by extension Rails::HTML::Sanitizer.allowed_uri?), which strips whitespace and control characters before decoding numeric character references. This allows an attacker to craft URIs like "javascript: alert(1)" where a stripped character terminates a semicolon-less numeric reference, causing the function to decode a longer reference and miss the javascript: scheme. A browser processes character references before stripping, revealing the actual scheme. The fix reorders decoding to occur before stripping, matching browser behavior. Loofah's default sanitize() path is unaffected as Nokogiri decodes entities first.
Affected products
- Loofah Loofah 2.25.0 to 2.25.2
- Rails Rails::HTML::Sanitizer affected versions
Identifiers
- CVE-2026-126209
- GHSA-p9wj-w8xq-vjx6
Timeline
- 2026-11-12: disclosed
- 2026-11-02: patched: Fix merged in PR #324