All 6 CVE vulnerabilities found in loofah, with AI-generated Chinese analysis, references, and POCs.
Vendor: flavorjones
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-73492 | Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons CWE-79 | 2.3 | Low | 2026-08-12 |
| CVE-2026-73491 | Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references CWE-184 | 2.3 | Low | 2026-08-12 |
| CVE-2026-73490 | Loofah: SVG `href` attribute bypasses local-reference restriction CWE-79 | 4.7 | Medium | 2026-08-12 |
| CVE-2022-23516 | Uncontrolled Recursion in Loofah CWE-674 | 7.5 | High | 2022-12-14 |
| CVE-2022-23515 | Improper neutralization of data URIs may allow XSS in Loofah CWE-79 | 6.1 | Medium | 2022-12-14 |
| CVE-2022-23514 | Inefficient Regular Expression Complexity in Loofah CWE-1333 | 7.5 | High | 2022-12-14 |
All 6 known CVE vulnerabilities affecting loofah with full Chinese analysis, references, and POCs where available.