Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| loofah | rubygems | >= 2.25.0, < 2.25.2 | 2.25.2 |
Miggo AIRoot Cause AnalysisThe analysis of the security advisory and the associated commit 5e91af861e3cdab47b91dd0b81f3afdfd13a5e19 clearly points to a single vulnerable function. The vulnerability description explicitly names Loofah::HTML5::Scrub.allowed_uri? as the source of the issue. The provided patch modifies this exact function in lib/loofah/html5/scrub.rb to handle named whitespace character references (	, 
) which were previously not sanitized. The old code relied on CGI.unescapeHTML, which does not decode these specific named entities, allowing a bypass of the javascript: URI filter. The new code adds a regular expression to explicitly strip these character references from the input string before validation. The test cases added in the same commit further confirm this by asserting that URIs with these obfuscations are now correctly identified as disallowed. Therefore, Loofah::HTML5::Scrub.allowed_uri? is the precise location of the vulnerability.
Loofah::HTML5::Scrub.allowed_uri?lib/loofah/html5/scrub.rb