Loofah's allowed_uri? method incorrectly treats certain HTML-encoded javascript: or vbscript: URIs as safe when the scheme is split by a numeric character reference without a trailing semicolon, followed by a whitespace character. This can cause browsers to interpret the URI as a script execution, potentially enabling cross-site scripting (XSS) if user-controlled URLs validated by allowed_uri? are rendered in browser-interpreted URI attributes. The default sanitize() method is not affected. The issue is fixed in Loofah version 2.25.3.