CVE-2026-73490: 
Ruby vulnerability analysis and mitigation

CVE-2026-73490 is a security feature bypass vulnerability in Loofah, a Ruby library for sanitizing HTML/XML documents built on Nokogiri. The flaw exists in Loofah's HTML5 sanitizer, which restricted only the deprecated xlink:href attribute on SVG use and feImage elements to local references, while failing to apply the same restriction to the plain href attribute accepted by modern browsers per the SVG 2 specification. All versions prior to 2.25.2 are affected. It was discovered by maintainer Mike Dalessio during a security audit and disclosed on July 15, 2026, with a CVE published on August 12, 2026. The CVSS v3.1 base score is 4.7 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is an incomplete denylist (CWE-184) combined with improper neutralization of SVG input (CWE-79). Loofah's scrub_attributes method in lib/loofah/html5/scrub.rb enforced local-reference restrictions on SVG elements (such as use, animate, altGlyph, and feImage) only for the xlink:href attribute, leaving the SVG 2 plain href attribute unrestricted. An attacker can craft a sanitized SVG containing <use href="https://same-origin-domain/malicious.svg"/>, which passes Loofah's sanitizer intact and, when rendered by a browser, loads and executes content from the referenced same-origin document. The fix introduced a SVG_HREF_ATTRIBUTES set covering both xlink:href and href, and updated the scrubbing logic to check both attributes (GitHub Advisory, Fix Commit).

A successful exploit allows an unauthenticated attacker to cause a victim's browser to load and render external same-origin SVG content containing scripts or other dangerous payloads, effectively achieving cross-site scripting in the context of the application. Additionally, feImage elements can silently load external images from attacker-controlled servers, enabling user tracking. Availability is not impacted, but confidentiality and integrity are partially affected due to potential script execution and data exfiltration within the same-origin context. Modern browser cross-origin restrictions limit but do not eliminate the risk (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires user interaction (a victim must render the crafted SVG in a browser) and high attack complexity, as the attacker must control a same-origin resource containing malicious content. The EPSS score is approximately 0.0018 (0.18%), reflecting low near-term exploitation probability (Red Hat CVE, GitHub Advisory).

1. Identify a target application: Find a web application that accepts user-supplied SVG content and sanitizes it using Loofah's default allowlist (versions < 2.25.2).
2. Craft a malicious SVG payload: Create an SVG document using the plain href attribute (not xlink:href) on a use or feImage element referencing a same-origin external document, e.g., <svg><use href="/attacker-controlled-path/malicious.svg"/></svg>.
3. Host malicious same-origin content: Place a malicious SVG file at a same-origin path accessible to the target application (e.g., via a file upload feature or another injection point), containing scripts or other dangerous content.
4. Submit the crafted SVG: Upload or inject the crafted SVG through the application's user input mechanism (e.g., a profile editor, comment field, or document upload).
5. Trigger victim rendering: Induce a victim user to view the page containing the sanitized SVG (e.g., via phishing or a shared link). The browser loads and renders the referenced same-origin SVG, executing any embedded scripts in the context of the application's origin (GitHub Advisory, Fix Commit).

• Network: Outbound HTTP requests from a victim's browser to same-origin paths containing .svg files not directly linked by the application; unexpected image load requests to external servers originating from SVG feImage elements (potential tracking beacons).
• Logs: Application access logs showing requests to SVG files from unexpected referrers or in unusual sequences; server-side logs showing SVG files being fetched as sub-resources of sanitized content pages.
• File System: Presence of unexpected .svg files in user-accessible upload directories containing <script> tags or external resource references; SVG files with href attributes pointing to external or same-origin paths in user-generated content storage.

Upgrade Loofah to version 2.25.2 or later, which restricts both href and xlink:href attributes on SVG use, feImage, and related elements to local same-document references. For applications unable to upgrade immediately, consider adding server-side post-processing to strip or restrict href attributes on SVG elements in user-supplied content, or disable SVG support in user input entirely if not required. The fix is available via RubyGems and was released on July 15, 2026 (Loofah Release, GitHub Advisory).

The vulnerability was discovered and reported by the library's own maintainer, Mike Dalessio, during a proactive security audit, reflecting responsible self-disclosure practices. Red Hat tracked the issue via Bugzilla (Bug #2514992) and published a CVE advisory, indicating downstream impact on Red Hat-distributed Ruby packages. The NixPkgs security tracker also opened a tracking issue for affected Ruby packages (Red Hat CVE, GitHub PR).