GHSA-8whx-365g-h9vv (loofah): Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

21-Jul-2026 1

Originally appeared on RubySec.## Summary Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript: URIs when the scheme is split or prefixed by the HTML5 named character references (tab) or (line feed). This is a bypass of the fix for GHSA-46fp-8...

RUBYONRAILS

to get 30% discount on our bundle!

Prepare for your next tech interview with our comprehensive collection of programming interview guides. Covering JavaScript, Ruby on Rails, React, and Python, these highly-rated books offer thousands of essential questions and answers to boost your interview success. Buy our 'Ultimate Job Interview Preparation eBook Bundle' featuring 2200+ questions across multiple languages.

Ultimate Job Interview Preparation eBook Bundle

GHSA-8whx-365g-h9vv (loofah): Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

RUBYONRAILS

Bestseller

Tags

Related Links

Useful Links

Quick Links

Get in Touch