Loofah's allowed_uri? method incorrectly treats data: URIs with HTML5 named character references in the mediatype as safe text/plain, while browsers interpret them as text/html. This discrepancy can lead to cross-site scripting (XSS) vulnerabilities when user-controlled URLs validated by allowed_uri? are rendered in browser-interpreted URI attributes. The issue affects Loofah versions 2.25.2 and >=2.25.2 <2.25.3 and is fixed in version 2.25.3.