Loofah versions prior to 2.25.3 contain a CSS sanitization bypass vulnerability where escaped parentheses in CSS url() functions evade detection. This allows an attacker to craft a sanitized style attribute that causes a viewer's browser to make requests to attacker-controlled URLs, leaking the viewer's IP address, user agent, and access timing. No script execution or response reading is possible. The issue affects applications using Loofah's default allowlist to sanitize user HTML and display it to others.