CVE-2026-73491

Name of the Vulnerable Software and Affected Versions Loofah versions 2.25.0 through 2.25.1

Description Loofah is a library for manipulating and transforming HTML/XML documents and fragments. The allowed uri? function within Loofah::HTML5::Scrub fails to reject javascript: URIs when the scheme is split or prefixed with HTML5 named whitespace character references such as 	 or 
. Because CGI.unescapeHTML does not remove these references, the function incorrectly identifies the URL as safe. A browser, however, decodes and strips these characters, leading to the execution of the javascript: URL. This issue specifically affects callers that pass HTML-encoded strings directly to the allowed uri? function; the default sanitize() path is not affected.

Recommendations Update to version 2.25.2. Avoid passing HTML-encoded strings directly to the allowed uri? function.