This vulnerability arises because Loofah::HTML5::Scrub.allowed_uri? accepts encoded javascript: or vbscript: URI schemes when the encoded colon or whitespace characters are represented by numeric character references without semicolons. Browsers decode those, turning the seemingly safe URI into a malicious scheme, which can therefore trigger client‑side script execution. The flaw belongs to the CWE‑79 class of cross‑site scripting vulnerabilities and, per the CVE metadata, also has an association with CWE‑184 (HTTP response splitting) and CWE‑76.

The vulnerability is present in the flavorjones:loofah gem versions 2.25.0 through 2.25.2 (inclusive). It affects any code that invokes Loofah::HTML5::Scrub.allowed_uri? with HTML‑encoded strings that have not been pre‑processed. The gem’s default sanitize() path is unaffected because it does not use this routine in the same way.

The CVSS score of 2.3 indicates a low severity assessment. The EPSS score is < 1 %, indicating a very low exploitation probability, and the issue is not listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. The likely attack vector requires an attacker to embed a malicious, encoded URI in input that will be passed to allowed_uri?, after which a browser will interpret the decoded JavaScript scheme. Successful exploitation would allow client‑side script execution, potentially leading to data theft or session hijacking if the victim’s browser executes the code.