CyberRota Analysis
AI-GeneratedThe vulnerability affects versions 2.25.0 to 2.25.2 of the Loofah library, which is used for processing HTML/XML documents in Java applications. It allows for the execution of potentially harmful JavaScript or VBScript through improperly handled URI schemes, posing a risk of cross-site scripting (XSS) attacks for applications that directly pass HTML-encoded strings to the `allowed_uri?` method. Developers using affected versions should prioritize updating to version 2.25.2 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as :, 	, 
, or 
. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.