The Loofah Ruby gem's allowed_uri? method does not properly reject javascript: or vbscript: URIs if the scheme is obfuscated using numeric character references lacking trailing semicolons (e.g., &#58 instead of &#58;). While allowed_uri? uses CGI.unescapeHTML which only decodes numeric character references with semicolons, browsers decode these references even without semicolons, causing the scheme to be interpreted as executable javascript:. This discrepancy allows bypassing the URI scheme validation, leading to potential XSS when user-controlled URLs validated by allowed_uri? are rendered in HTML attributes. The default Loofah sanitize() method is unaffected because Nokogiri decodes entities before Loofah processes URIs. The vulnerability affects Loofah versions >=2.25.0 and <2.25.2 and was responsibly disclosed by GitHub user @MoonFuji.

Applications that use Loofah's allowed_uri? method to validate user-supplied URLs before rendering them into href or other URI attributes may be vulnerable to cross-site scripting (XSS) attacks. This includes direct calls to allowed_uri? and higher-level features relying on it, such as Action Text 8.2's markdown link validation. The vulnerability allows malicious javascript: URIs to bypass validation due to incomplete decoding of numeric character references, potentially enabling script execution in the browser.

Upgrade Loofah to version 2.25.2 or later, where this issue is fixed. The vendor advisory explicitly states that upgrading to Loofah >= 2.25.2 mitigates the vulnerability. No other mitigation actions are indicated.