Flavorjones
Monthly
Cross-site scripting in Loofah 2.25.0-2.25.1 is possible when applications call `Loofah::HTML5::Scrub.allowed_uri?` directly with HTML-encoded strings, because the method fails to detect `javascript:` or `vbscript:` schemes disguised via semicolon-less numeric character references such as `:` (colon) or `	` (tab). This is a bypass of the prior fix in GHSA-46fp-8f5p-pf2m, which covered semicoloned references (`:`) but not the semicolon-less form that browsers still decode and execute. Loofah's default `sanitize()` path is not affected; only direct callers of the string-level `allowed_uri?` API - including Action Text 8.2's markdown link validation - are at risk. No public exploit identified at time of analysis; CVSS 4.0 scores this 2.3, reflecting narrow attack surface and high exploitation complexity.
Cross-site scripting bypass in Loofah 2.25.0-2.25.1 allows attackers to smuggle `javascript:` URIs past the `allowed_uri?` helper by inserting HTML5 named whitespace character references (`	` or `
`) into the scheme. This is a partial bypass of the earlier fix for GHSA-46fp-8f5p-pf2m, which patched numeric character references but not named forms. Only callers that invoke `allowed_uri?` directly with HTML-encoded strings are vulnerable - including Action Text 8.2 markdown link validation - while Loofah's default `sanitize()` pipeline is explicitly unaffected. No public exploit identified at time of analysis; vendor-released patch in version 2.25.2.
SVG href attribute bypass in Loofah prior to 2.25.2 allows a crafted sanitized SVG to reference arbitrary same-origin external documents, defeating the HTML5 sanitizer's local-reference restriction. Applications accepting user-supplied SVG content and rendering it to other users are directly affected: SVG use elements can load and render same-origin external SVG containing scripts, while feImage elements can silently fetch external images for tracking. No public exploit or CISA KEV listing exists at time of analysis, but the bypass technique is straightforward and publicly disclosed via the GHSA advisory and PR diff.
Cross-site scripting in Loofah 2.25.0-2.25.1 is possible when applications call `Loofah::HTML5::Scrub.allowed_uri?` directly with HTML-encoded strings, because the method fails to detect `javascript:` or `vbscript:` schemes disguised via semicolon-less numeric character references such as `:` (colon) or `	` (tab). This is a bypass of the prior fix in GHSA-46fp-8f5p-pf2m, which covered semicoloned references (`:`) but not the semicolon-less form that browsers still decode and execute. Loofah's default `sanitize()` path is not affected; only direct callers of the string-level `allowed_uri?` API - including Action Text 8.2's markdown link validation - are at risk. No public exploit identified at time of analysis; CVSS 4.0 scores this 2.3, reflecting narrow attack surface and high exploitation complexity.
Cross-site scripting bypass in Loofah 2.25.0-2.25.1 allows attackers to smuggle `javascript:` URIs past the `allowed_uri?` helper by inserting HTML5 named whitespace character references (`	` or `
`) into the scheme. This is a partial bypass of the earlier fix for GHSA-46fp-8f5p-pf2m, which patched numeric character references but not named forms. Only callers that invoke `allowed_uri?` directly with HTML-encoded strings are vulnerable - including Action Text 8.2 markdown link validation - while Loofah's default `sanitize()` pipeline is explicitly unaffected. No public exploit identified at time of analysis; vendor-released patch in version 2.25.2.
SVG href attribute bypass in Loofah prior to 2.25.2 allows a crafted sanitized SVG to reference arbitrary same-origin external documents, defeating the HTML5 sanitizer's local-reference restriction. Applications accepting user-supplied SVG content and rendering it to other users are directly affected: SVG use elements can load and render same-origin external SVG containing scripts, while feImage elements can silently fetch external images for tracking. No public exploit or CISA KEV listing exists at time of analysis, but the bypass technique is straightforward and publicly disclosed via the GHSA advisory and PR diff.