DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-5QHF-9PHG-95M2: GHSA-5QHF-9PHG-95M2: Stored Cross-Site Scripting via Parser Differential in Loofah allowed_uri?

#security #cve #cybersecurity #ghsa

GHSA-5QHF-9PHG-95M2: Stored Cross-Site Scripting via Parser Differential in Loofah allowed_uri?

Vulnerability ID: GHSA-5QHF-9PHG-95M2
CVSS Score: 8.8
Published: 2026-07-21

A critical HTML sanitization bypass vulnerability in the Ruby library Loofah allows unauthenticated remote attackers to execute Stored Cross-Site Scripting (XSS) attacks. By using semicolon-less numeric character references (NCRs) to encode protocol characters, attackers can evade backend URI verification filters while ensuring the malicious protocol is successfully decoded and executed by client-side web browsers.

TL;DR

Loofah fails to sanitize 'javascript:' URIs when colons and whitespace are represented by numeric character references without trailing semicolons, enabling Stored XSS.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79 / CWE-436
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 8.8 (High)
  • EPSS Score: N/A
  • Primary Impact: Stored Cross-Site Scripting (XSS)
  • Exploit Status: Proof-of-Concept Available
  • CISA KEV Status: Not Listed

Affected Systems

  • Ruby on Rails applications utilizing rails-html-sanitizer
  • Any Ruby applications using the Loofah gem for HTML sanitization
  • Loofah: < 2.25.2 (Fixed in: 2.25.2)

Code Analysis

Commit: f1be9d8

Merge pull request from ghsa-5qhf-9phg-95m2 to fix unescaped numeric character references in allowed_uri?

--- a/lib/loofah/html5/scrub.rb
+++ b/lib/loofah/html5/scrub.rb
Enter fullscreen mode Exit fullscreen mode

Exploit Details

Mitigation Strategies

  • Upgrade Loofah dependency to version 2.25.2 or above
  • Implement a robust Content Security Policy (CSP) blocking inline scripts
  • Configure Web Application Firewall (WAF) filtering for semicolon-less NCRs

Remediation Steps:

  1. Run 'bundle update loofah' in your application root directory.
  2. Verify that the Loofah version in Gemfile.lock is updated to 2.25.2 or higher.
  3. Ensure all test suites pass after the dependency upgrade.
  4. Deploy the updated code to production environments.

References

Read the full report for GHSA-5QHF-9PHG-95M2 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)