GHSA-9wjq-cp2p-hrgf

Medium

Published: —Translated: 27/07/2026(UTC)NVD NIST

Summary

Loofah's HTML5 sanitizer restricted only the xlink:href attribute on certain SVG elements to local, same-document references. Browsers also accept a plain href attribute as an alternative to the deprecated xlink:href per the SVG 2 spec, but Loofah did not apply the same restriction to it.

Risk Assessment

An attacker can inject external URIs into the href attribute on SVG elements, potentially leading to data leakage or XSS attacks.

Recommendation

Update the Loofah library to a version that includes a fix restricting the href attribute on SVG elements to local references.

Original NVD description (English source)

## Summary Loofah's HTML5 sanitizer restricted only the xlink:href attribute on certain SVG elements to local, same-document references. Browsers also accept a plain href attribute as an alternative to the deprecated xlink:href per the SVG 2 spec, but Loofah did not apply the same restriction to it