Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references
Published: July 15, 2026
SECURITY IDENTIFIERS
- CVE: CVE-2026-73491 (NVD)
- GHSA: GHSA-8whx-365g-h9vv
- Vendor Advisory: https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv
GEM
UNAFFECTED VERSIONS
< 2.25.0
PATCHED VERSIONS
>= 2.25.2
DESCRIPTION
Summary
Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript: URIs when the scheme is split or prefixed by the HTML5 named character references 	 (tab) or 
 (line feed).
This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled the equivalent numeric character references (	, , ) but did not cover the named forms.
RELATED
- https://nvd.nist.gov/vuln/detail/CVE-2026-73491
- https://rubygems.org/gems/loofah/versions/2.25.2
- https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md#2252--2026-07-15
- https://github.com/flavorjones/loofah/commit/5e91af861e3cdab47b91dd0b81f3afdfd13a5e19
- https://github.com/advisories/GHSA-46fp-8f5p-pf2m
- https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv
- https://github.com/advisories/GHSA-8whx-365g-h9vv