GHSA-5qhf-9phg-95m2: Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

July 21, 2026

Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript: or vbscript: URIs when the scheme is split by a numeric character reference that has no trailing semicolon. A browser decodes such references and resolves the URL to an executable javascript: scheme, while allowed_uri? reports it safe.

References

github.com/advisories/GHSA-5qhf-9phg-95m2
github.com/flavorjones/loofah/commit/f1be9d893b5a8dd79240441a912d8897e74c38c0
github.com/flavorjones/loofah/releases/tag/v2.25.2
github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2

Code Behaviors & Features

Detect and mitigate GHSA-5qhf-9phg-95m2 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →