Executive brief
Loofah is a library that cleans and sanitizes HTML/XML documents to prevent malicious content. A vulnerability in versions 2.25.0 through 2.25.1 allows attackers to bypass URL validation by encoding whitespace characters in javascript: URIs, which browsers decode and execute. This affects only direct calls to the validation function with HTML-encoded input; the default sanitization path is not affected. The issue is fixed in version 2.25.2.
Technical details
The vulnerability exists in the Loofah::HTML5::Scrub.allowed_uri? method, which is responsible for validating whether URIs are safe to include in sanitized HTML. The method fails to properly handle HTML5 named whitespace character references (	 and 
) that prefix or split javascript: URI schemes. While CGI.unescapeHTML leaves these character references intact, browsers decode and strip them when rendering, allowing the resulting javascript: URL to execute. The issue only impacts callers who directly pass HTML-encoded strings to allowed_uri?; Loofah's default sanitize() function is unaffected. The fix was implemented in version 2.25.2 to properly decode and reject these obfuscated URIs.
Affected products
- Loofah Loofah 2.25.0 through 2.25.1
Timeline
- 2026-07-15: patched: Fixed in version 2.25.2