GHSA-46fp-8f5p-pf2m Improper detection of disallowed URIs by Loofah `allowed_uri?`
Attackers can bypass URI validation to inject JavaScript, causing XSS in applications directly using the allowed_uri? helper.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-46fp-8f5p-pf2m?
GHSA-46fp-8f5p-pf2m is a cross-site scripting vulnerability in loofah, published on 18 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Summary
Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript: URIs when the scheme is split by HTML entity-encoded control characters such as 
 (carriage return), 
 (line feed), or 	 (tab).
Details
The allowed_uri? method strips literal control characters before decoding HTML entities. Payloads like java
script:alert(1) survive the control character strip, then 
 is decoded to a carriage return, producing java\rscript:alert(1).
Note that the Loofah sanitizer's default sanitize() path is not affected because Nokogiri decodes HTML entities during parsing before Loofah evaluates the URI protocol. This issue only affects direct callers of the allowed_uri? string-level helper when passing HTML-encoded strings.
Impact
Applications that call Loofah::HTML5::Scrub.allowed_uri? to validate user-controlled URLs and then render approved URLs into href or other browser-interpreted URI attributes may be vulnerable to cross-site scripting (XSS).
This only affects Loofah 2.25.0.
Mitigation
Upgrade to Loofah >= 2.25.1.
Credit
Responsibly reported by HackOne user @smlee.
Which versions are affected by GHSA-46fp-8f5p-pf2m?
2 open source packages ship an affected version, including loofah.
| Package | Affected | Fixed in |
|---|---|---|
loofah RubyGems | From 2.25.0 | 2.25.1 |
loofah RubyGems | From 2.25.0 | 2.25.1 |
How do I fix GHSA-46fp-8f5p-pf2m?
Upgrade loofah to 2.25.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-46fp-8f5p-pf2m being exploited?
There is no known exploitation of GHSA-46fp-8f5p-pf2m in the wild and no public exploit code.