The Loofah 2.25.0‑2.25.1 library contains a flaw in the allowed_uri? method. It fails to reject javascript: URLs that are split or prefixed with the HTML5 named whitespace character references 	 or 
. This omission allows an attacker that supplies HTML‑encoded input to traverse the library as if it were safe, while browsers later decode and execute the resulting javascript: URI, enabling arbitrary client‑side script execution. The weakness corresponds to CWE‑184 and results in a cross‑site scripting or client‑side code execution vulnerability.

Vendors: flavorjones: Loofah. Versions impacted: 2.25.0 and 2.25.1. The problem appears only when callers pass HTML-encoded strings directly to Loofah::HTML5::Scrub.allowed_uri?; Loofah's default sanitize() path remains unaffected. All other versions are considered safe.

The vulnerability earned a CVSS score of 2.3, indicating low severity. With no EPSS data available and no listing in the CISA KEV catalog, the risk of exploitation appears low under normal circumstances, but it can be triggered when an application directly invokes allowed_uri? on encoded data. Attackers must have the ability to supply such input—common in content‑creation or user‑generated data scenarios—after which the browser will execute the embedded JavaScript.