Most recent entries from all

EUVD-2026-351965

fkie_cve-2026-73491

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character references &Tab; or &NewLine;. CGI.unescapeHTML leaves those references intact, so allowed_uri? reports the URL safe even though a browser decodes and strips the tab or line feed and executes the resulting javascript: URL. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

GHSA-8whx-365g-h9vv — Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

Affected: RubyGems: loofah

## Summary

`Loofah::HTML5::Scrub.allowed_uri?` does not correctly reject `javascript:` URIs when the scheme is split or prefixed by the HTML5 named character references `&Tab;` (tab) or `&NewLine;` (line feed).

This is a bypass of the fix for [GHSA-46fp-8f5p-pf2m](https://github.com/flavorjones/loofah/security/advisories/GHSA-46fp-8f5p-pf2m), which handled the equivalent numeric character references (`	`, `
`, ``) but did not cover the named forms.

## Details

`allowed_uri?` decodes HTML entities with `CGI.unescapeHTML`, which handles numeric character references but not HTML5 named character references. Payloads like `java&Tab;script:alert(1)` are therefore left intact, so the method does not recognize the `javascript:` scheme and returns `true`. A browser, however, decodes `&Tab;` and `&NewLine;` to tab and line feed and strips them from the URL during parsing, producing `javascript:alert(1)`.

`&Tab;` and `&NewLine;` are the only relevant named character references: across the HTML5 named-character table, they are the only two that decode to characters the WHATWG URL parser strips from a URL (U+0009 and U+000A; there is no named reference for U+000D). ` ` / `&NonBreakingSpace;` decode to U+00A0, which browsers do not strip, so they aren't usable for this bypass.

Note that Loofah's default `sanitize()` path is **not** affected, because Nokogiri decodes or entity-escapes HTML entities during parsing before Loofah evaluates the URI protocol. This issue o…

UBUNTU-CVE-2026-73491

Affected: Ubuntu:16.04:LTS: ruby-loofah, Ubuntu:18.04:LTS: ruby-loofah, Ubuntu:20.04:LTS: ruby-loofah, Ubuntu:22.04:LTS: ruby-loofah, Ubuntu:24.04:LTS: ruby-loofah, Ubuntu:26.10: ruby-loofah, Ubuntu:26.04:LTS: ruby-loofah