Loofah's allowed_uri? method fails to detect javascript: or vbscript: URIs when the scheme is split by numeric character references without trailing semicolons. Browsers decode these references and execute the URI, but allowed_uri? incorrectly marks them as safe. This affects callers that validate user-controlled URLs with allowed_uri? and then render them into browser-interpreted URI attributes, potentially enabling cross-site scripting (XSS). The default sanitize() method is not affected. The issue is fixed in Loofah version 2.25.2.