CVE-2026-73492

Name of the Vulnerable Software and Affected Versions Loofah versions 2.25.0 through 2.25.1

Description Loofah is a library for manipulating and transforming HTML/XML documents and fragments. The allowed uri? function within Loofah::HTML5::Scrub fails to reject javascript: or vbscript: URIs when the scheme is split by numeric character references without semicolons, such as &#58, &#9, &#10, or &#13. Because CGI.unescapeHTML leaves these references encoded, the function incorrectly identifies the URL as safe. However, web browsers decode these encoded colons or strip encoded whitespace, leading to the execution of the URI scheme. This issue only affects callers that pass HTML-encoded strings directly to the allowed uri? function; the default sanitize() path is not affected.

Recommendations Update to version 2.25.2. Avoid passing HTML-encoded strings directly to the allowed uri? function.