Description
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character references 	 or 
. CGI.unescapeHTML leaves those references intact, so allowed_uri? reports the URL safe even though a browser decodes and strips the tab or line feed and executes the resulting javascript: URL. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| flavorjones | loofah | >= 2.25.0, < 2.25.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-loofah | 2.25.2-1 | — |
| Debian 13 | ruby-loofah | No fix yet | — |
| Debian 12 | ruby-loofah | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ruby-loofah | No fix yet | — |
| Ubuntu 26.04 LTS | ruby-loofah | No fix yet | — |
| Ubuntu 24.04 LTS | ruby-loofah | No fix yet | — |
| Ubuntu 22.04 LTS | ruby-loofah | No fix yet | — |
| Ubuntu 20.04 LTS | ruby-loofah | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | ruby-loofah | No fix yet | — |
| Ubuntu 16.04 LTS | ruby-loofah | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | hawk2 | 2.7.2+git.1788518533.7d4dadd6-160000.1.1 | SUSE-SU-2026:24250-1 |
| SLES 16.0 | hawk2 | 2.7.2+git.1788518533.7d4dadd6-160000.1.1 | SUSE-SU-2026:24195-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | hawk2 | 2.7.2+git.1792148770.648dcddb-1.1 | openSUSE-SU-2026:12153-1 |
| openSUSE Leap 16.0 | hawk2 | 2.7.2+git.1788518533.7d4dadd6-160000.1.1 | openSUSE-SU-2026:22068-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | ruby3.2-rails-8.1 | 8.1.3-r9 | — |
| Wolfi rolling | ruby3.4-rails-8.1 | 8.1.3-r11 | — |
| Wolfi rolling | ruby4.0-rails-8.1 | 8.1.3-r10 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | loofah | >= 2.25.0, < 2.25.2 | 2.25.2 | GHSA-8whx-365g-h9vv |
Advisories 4
- SUSE-SU-2026:24250-1 Security update for hawk2 SUSE / openSUSE Security Updates · Oct 21, 2026
- SUSE-SU-2026:24195-1 Security update for hawk2 SUSE / openSUSE Security Updates · Oct 21, 2026
- openSUSE-SU-2026:22068-1 Security update for hawk2 SUSE / openSUSE Security Updates · Oct 19, 2026
- openSUSE-SU-2026:12153-1 hawk2-2.7.2+git.1792148770.648dcddb-1.1 on GA media SUSE / openSUSE Security Updates · Oct 17, 2026