Loofah versions prior to 2.25.3 improperly restrict local references in SVG elements <textPath> and <mpath>, allowing external URLs to bypass sanitization. This causes Firefox to fetch attacker-controlled URLs when rendering sanitized SVG content, leaking the viewer's IP address, user agent, and referrer. Chrome and WebKit are not affected by this fetch behavior. The vulnerability affects applications using Loofah's default allowlist or rails-html-sanitizer permitting SVG elements. A fix is available in Loofah 2.25.3.