Loofah XSS bypass in allowed_uri? via malformed character references

Executive brief

Loofah is a Ruby library used to sanitize and scrub HTML to prevent security vulnerabilities. A flaw in its URI validation helper allows specially crafted links (using 'javascript:' or 'vbscript:' schemes) to bypass security checks if they use specific encoding techniques. This could allow an attacker to perform cross-site scripting (XSS) attacks, potentially leading to unauthorized actions or data theft if the application relies on this specific helper to validate user-provided links.

Technical details

The `Loofah::HTML5::Scrub.allowed_uri?` method uses `CGI.unescapeHTML` to decode entities before checking for prohibited schemes like `javascript:`. However, `CGI.unescapeHTML` only decodes numeric character references that include a trailing semicolon (e.g., `:`). Browsers are more permissive and will decode references without semicolons (e.g., `&#58`). An attacker can bypass the filter by using these semicolon-less references to hide the colon or characters within the scheme name. While Loofah's primary `sanitize()` path is unaffected due to Nokogiri's pre-parsing, direct callers of `allowed_uri?` or features like Action Text 8.2's markdown validation are vulnerable. The issue is fixed in version 2.25.2.

Affected products

• flavorjones loofah >= 2.25.0, < 2.25.2

Timeline

• 2026-07-15: disclosed
• 2026-07-21: advisory
• 2026-07-21: patched

References

• https://api.github.com/users/MoonFuji
• https://github.com/MoonFuji
• https://api.github.com/users/MoonFuji/gists%7B/gist_id%7D
• https://api.github.com/users/MoonFuji/repos
• https://avatars.githubusercontent.com/u/100423572?v=4
• https://api.github.com/users/MoonFuji/events%7B/privacy%7D