DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-8WHX-365G-H9VV: GHSA-8whx-365g-h9vv: HTML5 Named Whitespace Bypass in Loofah allowed_uri? Validation

#security #cve #cybersecurity #ghsa

GHSA-8whx-365g-h9vv: HTML5 Named Whitespace Bypass in Loofah allowed_uri? Validation

Vulnerability ID: GHSA-8WHX-365G-H9VV
CVSS Score: 2.3
Published: 2026-07-21

The Loofah Ruby gem version 2.25.0 and 2.25.1 contains an incomplete validation vulnerability in its public string-level utility Loofah::HTML5::Scrub.allowed_uri?. This helper fails to detect 'javascript:' URIs that are split by HTML5 named whitespace character references such as and . Applications manually invoking this utility to validate links are vulnerable to stored Cross-Site Scripting (XSS), as browsers parse and remove these entities during rendering.

TL;DR

A bypass in Loofah's string validation helper allows attackers to construct executable javascript: URIs obfuscated with HTML5 named entities, leading to stored XSS.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-184 (Incomplete List of Disallowed Inputs)
  • Attack Vector: Network (Unauthenticated)
  • CVSS Score: 2.3 (Low / Scope-Dependent)
  • Impact: Stored Cross-Site Scripting (XSS)
  • Exploit Status: Proof-of-Concept
  • Vulnerable Method: Loofah::HTML5::Scrub.allowed_uri?

Affected Systems

  • loofah Ruby Gem
  • Ruby on Rails applications using Action Text with custom link validation rules
  • loofah: >= 2.25.0, < 2.25.2 (Fixed in: 2.25.2)

Code Analysis

Commit: 5e91af8

html5/scrub: strip whitespace character references in allowed_uri?

Exploit Details

  • GitHub Security Advisory: Exploit methodology and regression tests verifying bypass functionality using HTML5 whitespace entities.

Mitigation Strategies

  • Upgrade the loofah Ruby gem to version 2.25.2 or higher.
  • Implement application-level regex filters to remove HTML5 named whitespace references from user inputs prior to validation.

Remediation Steps:

  1. Locate manual usages of Loofah::HTML5::Scrub.allowed_uri? in your application codebase.
  2. Modify the project Gemfile to require loofah version >= 2.25.2.
  3. Run the command 'bundle update loofah' to update the local lockfile.
  4. Deploy the updated codebase and verify the version using 'bundle info loofah'.

References

Read the full report for GHSA-8WHX-365G-H9VV on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)