AIKIDO-2026-498891

loofah is vulnerable to Incomplete List of Disallowed Inputs

Incomplete List of Disallowed InputsGHSA-8whx-365g-h9vv Published 4 days ago

Low Risk

This Affects:

loofah

2.25.0 - 2.25.1

Fixed in 2.25.2

Are you affected? Scan for Free

TL;DR

Affected versions of loofah's Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs when the scheme is split by the HTML5 named character references &Tab; or &NewLine;. The helper decodes HTML entities with CGI.unescapeHTML, which handles numeric references but not these named forms, so payloads like java&Tab;script:alert(1) are incorrectly treated as safe. Browsers decode and strip those characters during URL parsing, producing an executable javascript: URI. This bypasses the earlier fix for numeric references (	, 
, ). Loofah's default sanitize() path is not affected; only callers of the public allowed_uri? helper (including higher-level features such as Action Text 8.2 markdown link validation) that then render the approved value into an href or similar attribute are at risk.

Who does this affect?

You are affected if you use a version in the vulnerable range and call Loofah::HTML5::Scrub.allowed_uri? (directly or via a feature built on it) with HTML-encoded, user-controlled URLs that are then rendered into a browser-interpreted URI attribute. The default sanitize() path is not affected.