The vulnerability lies in Loofah’s HTML5 sanitizer, which enforces the local‑reference restriction only for the xlink:href attribute on SVG use and feImage elements. Browsers also honor the plain href attribute, so a crafted SVG that is processed by Loofah can reference an arbitrary same‑origin external document. The referenced document may contain scripts or other malicious content, allowing attackers to execute code in the context of the sanitized page or to load external images for tracking purposes. This flaw thus enables a form of cross‑site scripting or remote code execution within applications that rely on Loofah to sanitize SVG input.

The bug affects the Loofah library provided by flavorjones. Applications that sanitize user-supplied SVG with Loofah‘s default allowlist prior to version 2.25.2 are vulnerable. Updating to Loofah 2.25.2 or a later release resolves the issue.

With a CVSS score of 4.7 the vulnerability is considered moderate. The EPSS score of 0.0018 indicates a low likelihood of exploitation, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is through malicious SVG uploads or embedded content that is sanitized by Loofah; an attacker who can supply such an SVG can cause the application to include or execute external resources from the same origin. While no public exploits are documented, the mechanism could be employed silently by attackers to carry out XSS or tracking through remote images. Therefore the risk level remains moderate, but remediation is advisable.