Loofah versions from 2.21.0 up to but not including 2.25.3 contain a mutation XSS vulnerability in their HTML5 scrubbers due to unescaped '<' and '>' characters in attribute values. This flaw allows browsers to parse output into different markup, potentially enabling cross-site scripting attacks. The vulnerability affects the :strip scrubber in all browsers and the :prune and :escape scrubbers in WebKit browsers like Safari. Nokogiri versions prior to 1.19.5 also contribute to this issue by not escaping these characters properly. Upgrading to Loofah 2.25.3 or Nokogiri 1.19.5 or later mitigates the vulnerability.