AIKIDO-2026-349881

loofah is vulnerable to Cross-site Scripting (XSS)

Cross-site Scripting (XSS)GHSA-5qhf-9phg-95m2 Published Jul 16, 2026

Low Risk

This Affects:

loofah

2.25.0 - 2.25.1

Fixed in 2.25.2

Are you affected? Scan for Free

TL;DR

Affected versions of loofah are vulnerable to Cross-site Scripting (XSS) via a bypass in Loofah::HTML5::Scrub.allowed_uri?. The helper does not reject javascript: or vbscript: URIs when the scheme is split by numeric character references without a trailing semicolon (e.g. javascript&#58alert(1) or java&#9script:alert(1)). CGI.unescapeHTML leaves those forms undecoded, so scheme detection fails and the method returns true, while browsers decode them and execute the URI. This bypasses the prior fix for GHSA-46fp-8f5p-pf2m, which only covered references with a trailing ;.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and call Loofah::HTML5::Scrub.allowed_uri? (directly or via higher-level features such as Action Text markdown link validation) with HTML-encoded URI strings. The default sanitize() path is not affected.