GHSA-9WJQ-CP2P-HRGF: SVG href Attribute Bypass in Loofah HTML/XML Sanitizer

Vulnerability ID: GHSA-9WJQ-CP2P-HRGF
CVSS Score: 4.7
Published: 2026-07-21

A security logic flaw in Loofah, a Ruby HTML/XML sanitization library, allowed unauthenticated attackers to bypass local-reference restrictions on SVG elements. Prior to version 2.25.2, Loofah only sanitized the legacy namespaced "xlink:href" attribute when enforcing local URI fragments on SVG elements like "". It did not validate or sanitize the plain, non-namespaced "href" attribute introduced in the SVG 2 standard. This structural omission allowed attackers to construct SVG elements referencing external domains, paving the way for arbitrary resource loading and cross-site scripting (XSS).

TL;DR

Loofah fails to sanitize the SVG 2 plain 'href' attribute, enabling attackers to bypass local-reference restrictions and inject external resources or trigger Cross-Site Scripting.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-79
• Attack Vector: Network (AV:N)
• CVSS v3.1 Score: 4.7 (Medium)
• EPSS Score: Not Applicable
• Impact: Cross-Site Scripting (XSS) / Resource Injection
• Exploit Status: Proof-of-Concept
• KEV Status: Not Listed

Affected Systems

• Loofah Ruby Gem
• loofah: < 2.25.2 (Fixed in: 2.25.2)

Code Analysis

Commit: 20867b9

Merge pull request from flavorjones to address SVG href bypass

diff --git a/lib/loofah/html5/safelist.rb b/lib/loofah/html5/safelist.rb
index c73bcb8..ad33552 100644
--- a/lib/loofah/html5/safelist.rb
+++ b/lib/loofah/html5/safelist.rb
@@ -605,6 +605,11 @@ module SafeList
         "stroke",
       ])

+      SVG_HREF_ATTRIBUTES = Set.new([
+        "xlink:href",
+        "href",
+      ])
+
       SVG_ALLOW_LOCAL_HREF = Set.new([
         "altGlyph",
         "animate",
diff --git a/lib/loofah/html5/scrub.rb b/lib/loofah/html5/scrub.rb
index 273d2ec..817568e 100644
--- a/lib/loofah/html5/scrub.rb
+++ b/lib/loofah/html5/scrub.rb
@@ -71,7 +71,7 @@ def scrub_attributes(node)
             end

             next unless SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) &&
-              attr_name == "xlink:href" &&
+              SafeList::SVG_HREF_ATTRIBUTES.include?(attr_name) &&
               attr_node.value =~ /^\s*[^#\s].*/m

             attr_node.remove

Mitigation Strategies

• Upgrade the Loofah gem dependency to version 2.25.2 or higher.
• Implement a robust Content Security Policy (CSP) with restrictive 'object-src' and 'img-src' directives.
• Deploy web application firewall (WAF) signatures to intercept incoming payloads containing plain SVG href attributes pointing to external resources.

Remediation Steps:

1. Open your application Gemfile and update the loofah dependency line: gem 'loofah', '>= 2.25.2'
2. Execute the command 'bundle update loofah' to fetch and apply the updated package.
3. Run automated tests to confirm that SVG parsing continues to operate correctly while blocking non-local resources.
4. Inspect Gemfile.lock to ensure that no indirect dependencies are pinning Loofah to a version below 2.25.2.

References

• GitHub Advisory Database entry
• Loofah Repository Security Advisory page
• Patch Commit Link
• Loofah v2.25.2 Release Notes

Read the full report for GHSA-9WJQ-CP2P-HRGF on our website for more details including interactive diagrams and full exploit analysis.