Loofah: CSS url() sanitization bypass via escaped parenthesesGHSA-m3x9-938q-5767
MEDIUMFix: flavorjones/loofah#324GHSA-m3x9-938q-5767 is a medium-severity (CVSS 4.7) CWE-180 vulnerability in loofah. A fix is available for loofah — see the affected versions and patch details below.
Real-World Exposure
loofahReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Loofah::HTML5::Scrub.scrub_css rejected any property whose top-level Crass tokens included a :url or :bad_url, and left url out of the allowed CSS functions. Both checks ran only against the first parse of the style attribute. When scrub_css rebuilt each property it emitted identifiers with their CSS escapes decoded, so parentheses written as escapes — url\28 …\29 — hid the url token from the checks, and the rebuilt value was re-parsed into a live url() that nothing checked again. An escaped property name, six-digit escapes, escaped comments and escaped quotes all reached the same place.
Impact
A sanitized style attribute could make a viewer's browser issue a request to an attacker-chosen URL. list-style fetches on render with no interaction, cursor on hover. That leaks the viewer's IP address, user agent and access timing, and can reach hosts routable only from the viewer's network. No script survives sanitization and the attacker cannot read the response, so the request itself is the whole impact.
Applications that sanitize user-supplied HTML with Loofah's default allowlist and display it to other people are affected.
Mitigation
Upgrade to Loofah >= 2.25.3.
Credit
Reported by NotAFlightRisk through GitHub's private vulnerability reporting.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 💎RubyGems | loofah | all versions | 2.25.3bundle update loofah --conservative |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for loofah, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update loofah to 2.25.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-m3x9-938q-5767 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is GHSA-m3x9-938q-5767 in your dependencies?
Find it across RubyGems, including transitive dependencies.