GHSA-8whx-365g-h9vv
LowSummary
Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript: URIs when the scheme is split or prefixed by the HTML5 named character references 	 (tab) or 
 (line feed). This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled the equivalent numeric character references.
Risk Assessment
An attacker can bypass URI sanitization using named character references, enabling JavaScript injection and XSS attacks.
Recommendation
Update the Loofah library to a version that correctly rejects javascript: URIs with named character references.
Original NVD description (English source)
## Summary Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript: URIs when the scheme is split or prefixed by the HTML5 named character references 	 (tab) or 
 (line feed). This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled the equivalent numeric chara