Loofah CVE-2026-73491

Exploitation requires that the target application calls Loofah::HTML5::Scrub.allowed_uri? directly with a user-controlled HTML-encoded string - this is an explicitly non-default usage pattern. Loofah's standard sanitize() pipeline is not vulnerable because Nokogiri decodes HTML entities at the DOM parsing stage before URI scheme evaluation, preventing the bypass. The bypass is limited to exactly two named character references: 	 (U+0009) and 
 (U+000A), which are the only HTML5 named references that decode to characters the WHATWG URL parser strips from URLs;   and other named references cannot be used. Affected higher-level features include Action Text 8.2 markdown link validation. Limiting factors: only Loofah 2.25.0-2.25.1 is affected (prior versions and 2.25.2+ are not); applications must render the approved URL into a browser-interpreted URI attribute such as href for XSS impact to materialize; and CVSS PR:L indicates the attacker needs at least some access level to submit a URL for validation.

The CVSS 4.0 score of 2.3 (AV:N/AC:H/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L) accurately captures the constrained attack surface: the vulnerability is network-reachable but requires high attack complexity because exploitation depends on a non-default application pattern - directly calling allowed_uri? with HTML-encoded strings rather than routing through sanitize(). The subsequent-system impact metrics (SC:L/SI:L) reflect XSS reaching the victim's browser rather than the server itself. No CISA KEV listing and no public exploit code identified, indicating this is not under active widespread exploitation. EPSS data was not provided; given the narrow applicability (only direct allowed_uri? callers), opportunistic mass exploitation is unlikely. The real-world priority is highest for Rails applications using Action Text 8.2 markdown link validation, which is a confirmed affected higher-level feature. For the majority of Loofah consumers using the default sanitize() path, this vulnerability does not apply.

An attacker submits the URL java	script:alert(document.cookie) through a feature that calls Loofah::HTML5::Scrub.allowed_uri? directly, such as Action Text 8.2 markdown link validation. The method returns true because CGI.unescapeHTML leaves 	 intact and the scheme regex does not match javascript:. The application renders the approved URL into an href attribute; when a victim clicks the link, the browser's WHATWG URL parser strips the tab character and executes the javascript: payload in the victim's session. The proof-of-concept payloads are fully documented in the vendor advisory GHSA-8whx-365g-h9vv, though no standalone public exploit tool has been identified.