Skip to content

Loofah: SVG `href` attribute bypasses local-reference restriction

Moderate severity GitHub Reviewed Published Jul 15, 2026 in flavorjones/loofah • Updated Aug 12, 2026

No open alerts for this advisory

Give feedback on Dependabot alerts