GHSA-5qhf-9phg-95m2

Low

Published: —Translated: 27/07/2026(UTC)NVD NIST

Summary

Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript: or vbscript: URIs when the scheme is split by a numeric character reference that has no trailing semicolon. A browser decodes such references and resolves the URL to an executable javascript: scheme, while allowed_uri? considers it safe.

Risk Assessment

An attacker can bypass URI sanitization and inject JavaScript or VBScript code, leading to XSS attacks.

Recommendation

Update the Loofah library to a version that correctly rejects URIs with a scheme split by numeric character references.

Original NVD description (English source)

## Summary Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript: or vbscript: URIs when the scheme is split by a numeric character reference that has no trailing semicolon. A browser decodes such references and resolves the URL to an executable javascript: scheme, while allowed_ur