Quick answers
- Is CVE-2026-73491 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-73491 being exploited in the wild.
- How severe is CVE-2026-73491?
- Medium severity, with a CVSS score of 4, published 12 August 2026.
- Which products and versions are affected?
- loofah (RubyGems) ECOSYSTEM:introduced=2.25.0,fixed=2.25.2.
- Is there a fix for CVE-2026-73491?
- Yes. loofah (RubyGems): upgrade to 2.25.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-73491 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-73491?
- Check whether you run loofah (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- loofah (RubyGems): upgrade to 2.25.2 or later
bundle update loofah
Technical details
The vulnerability exists in the Loofah::HTML5::Scrub.allowed_uri? method, which is responsible for validating whether URIs are safe to include in sanitized HTML. The method fails to properly handle HTML5 named whitespace character references (	 and 
) that prefix or split javascript: URI schemes. While CGI.unescapeHTML leaves these character references intact, browsers decode and strip them when rendering, allowing the resulting javascript: URL to execute. The issue only impacts callers who directly pass HTML-encoded strings to allowed_uri?; Loofah's default sanitize() function is unaffected. The fix was implemented in version 2.25.2 to properly decode and reject these obfuscated URIs.
Affected products
- Loofah Loofah 2.25.0 through 2.25.1
Identifiers
- CVE-2026-73491
- GHSA-8whx-365g-h9vv
Timeline
- 2026-07-15: patched: Fixed in version 2.25.2