Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character references &Tab; or &NewLine;. CGI.unescapeHTML leaves those references intact, so allowed_uri? reports the URL safe even though a browser decodes and strips the tab or line feed and executes the resulting javascript: URL. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on
    top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript:
    URIs whose scheme is split or prefixed with the HTML5 named whitespace character references &Tab; or
    &NewLine;. CGI.unescapeHTML leaves those references intact, so allowed_uri? reports the URL safe even
    though a browser decodes and strips the tab or line feed and executes the resulting javascript: URL. This
    issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default
    sanitize() path is not affected. This issue is fixed in version 2.25.2. (CVE-2026-73491)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on     top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript:
    URIs whose scheme is split or prefixed with the HTML5 named whitespace character references 	 or     . CGI.unescapeHTML leaves those references intact, so allowed_uri? reports the URL safe even     though a browser decodes and strips the tab or line feed and executes the resulting javascript: URL. This     issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default     sanitize() path is not affected. This issue is fixed in version 2.25.2. (CVE-2026-73491)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
445904	SCA: security update for loofah (GHSA-8whx-365g-h9vv)	Tenable Cloud Security	SCA Checks	Local	low
445904	SCA: security update for loofah (GHSA-8whx-365g-h9vv)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
335148	Linux Distros Unpatched Vulnerability : CVE-2026-73491	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-73491

low

Tenable Plugins

low

low

low