GHSA-2j22-pr5w-6gq8 Loofah has improper detection of disallowed URIs via `allowed_uri?`

Not scored Published 26 Mar 2026

Attackers can bypass URI validation to inject JavaScript via encoded control characters, leading to XSS in applications directly using the allowed_uri? helper.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is GHSA-2j22-pr5w-6gq8?

GHSA-2j22-pr5w-6gq8 is a cross-site scripting vulnerability in loofah, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Summary

Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript: URIs when the scheme is split by HTML entity-encoded control characters such as &#13; (carriage return), &#10; (line feed), or &#9; (tab).

Details

The allowed_uri? method strips literal control characters before decoding HTML entities. Payloads like java&#13;script:alert(1) survive the control character strip, then &#13; is decoded to a carriage return, producing java\rscript:alert(1).

Note that the Loofah sanitizer's default sanitize() path is not affected because Nokogiri decodes HTML entities during parsing before Loofah evaluates the URI protocol. This issue only affects direct callers of the allowed_uri? string-level helper when passing HTML-encoded strings.

Impact

Applications that call Loofah::HTML5::Scrub.allowed_uri? to validate user-controlled URLs and then render approved URLs into href or other browser-interpreted URI attributes may be vulnerable to cross-site scripting (XSS).

This only affects Loofah 2.25.0.

Mitigation

Upgrade to Loofah >= 2.25.1.

Credit

Responsibly reported by HackOne user @smlee.

Which versions are affected by GHSA-2j22-pr5w-6gq8?

2 open source packages ship an affected version, including loofah.

Package	Affected	Fixed in
`loofah` RubyGems	From `2.25.0`	`2.25.1`
`loofah` RubyGems	From `2.25.0`	`2.25.1`

How do I fix GHSA-2j22-pr5w-6gq8?

Upgrade loofah to 2.25.1 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is GHSA-2j22-pr5w-6gq8 being exploited?

There is no known exploitation of GHSA-2j22-pr5w-6gq8 in the wild and no public exploit code.