[dependabot]

Bumps loofah from 2.25.2 to 2.25.3.

Release notes

Sourced from loofah's releases.

2.25.3 / 2026-11-01

Security

• Ensure Loofah::HTML5::Scrub.allowed_uri? rejects schemes split by a numeric character reference without a semicolon that ends at a character allowed_uri? strips (e.g. javascript&#x3a alert(1)) or at another character reference (e.g. javascript&#x3aalert(1)). Character references are now decoded before anything is stripped, as browsers do. See GHSA-p9wj-w8xq-vjx6. @​flavorjones
• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character reference /, which CGI.unescapeHTML does not decode and browsers read as /, and rejects data: URIs that disguise a disallowed mediatype with it (e.g. data:text&sol;html,<script>alert(1)</script>). Previously that mediatype was treated as malformed and fell back to the allowed text/plain. Only v2.25.2 is affected. See GHSA-jcff-cj73-4w4f. @​flavorjones
• Ensure Loofah::HTML5::Scrub.scrub_css does not decode CSS escapes in identifiers. Previously, escaped parentheses (e.g. url\28 http://example.com/\29) came out as a live url(), which could make the viewer's browser fetch an attacker-chosen URL. See GHSA-m3x9-938q-5767. @​flavorjones
• Ensure that href and xlink:href on SVG textPath and mpath elements are restricted to local (same-document) references. Previously SVG_ALLOW_LOCAL_HREF spelled textPath in lowercase, which never matched the name the HTML5 parser assigns inside <svg>, and omitted mpath entirely. See GHSA-345x-3rq2-jfrm. @​flavorjones
• Fix quadratic-time scrubbing of the href and xlink:href attributes of SVG elements. Only Ruby 3.1 and earlier are affected, because Ruby 3.2 introduced linear-time regexp matching. See GHSA-mf2j-8f84-cc9q. @​flavorjones
• Ensure HTML5 scrubber output does not turn into new markup when a browser parses it again. The fix is in Nokogiri v1.19.5, which escapes < and > in attribute values as the HTML standard requires, so Loofah now requires Nokogiri >= 1.19.5. See GHSA-h6v6-rg66-fqj4. @​flavorjones @​hackvertor

Dependencies

• Loofah now requires Ruby >= 3.2, the minimum that Nokogiri v1.19.x supports. We don't like dropping Ruby versions in a patch release, and we're sorry for the inconvenience, but it's the only way to make sure everyone gets the security fix in GHSA-h6v6-rg66-fqj4.

Added

• Loofah::HTML5::Scrub.prefixed_attribute_name and Loofah::HTML5::Scrub.scrub_attribute_value expose the html5lib attribute name and value rules, so downstream consumers can apply them instead of carrying their own copy. @​flavorjones

Fixed

• Fix :double_breakpoint, which left document fragments unchanged despite its documented example. The scrubber now changes only paragraphs inside the scrubbed node, and its run time on a document grows linearly, not quadratically, with the paragraph count. #309 @​OskarEichler
• Fix :whitewash, which passed CDATA sections through unchanged. Markup inside a CDATA section in Loofah.xml_fragment or Loofah.xml_document survived scrubbing and became live elements if the output was later parsed as HTML. The scrubber now escapes CDATA content, as :strip, :prune and :escape already do. On JRuby, every sanitizer now emits escaped CDATA content as a CDATA section, as on CRuby, instead of a text node that double-escaped it. #313 @​flavorjones (reported by @​MegaManSec)
• Fix :double_breakpoint, which raised NoMethodError on a paragraph that ends with a <br> after a double break. #314 @​flavorjones (reported by @​MegaManSec)
• Fix Loofah::HTML5::Scrub.allowed_uri?, which raised Encoding::CompatibilityError on a string in an encoding other than UTF-8 and ArgumentError on invalid UTF-8. It now transcodes the input to UTF-8 and returns false when the input has an invalid byte sequence or no UTF-8 representation. #315 @​flavorjones

New Contributors

• @​OskarEichler made their first contribution in flavorjones/loofah#309

Full Changelog: flavorjones/loofah@v2.25.2...v2.25.3

Changelog

Sourced from loofah's changelog.

2.25.3 / 2026-11-01

Security

• Ensure Loofah::HTML5::Scrub.allowed_uri? rejects schemes split by a numeric character reference without a semicolon that ends at a character allowed_uri? strips (e.g. javascript&#x3a alert(1)) or at another character reference (e.g. javascript&#x3aalert(1)). Character references are now decoded before anything is stripped, as browsers do. See GHSA-p9wj-w8xq-vjx6. @​flavorjones
• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character reference /, which CGI.unescapeHTML does not decode and browsers read as /, and rejects data: URIs that disguise a disallowed mediatype with it (e.g. data:text&sol;html,<script>alert(1)</script>). Previously that mediatype was treated as malformed and fell back to the allowed text/plain. Only v2.25.2 is affected. See GHSA-jcff-cj73-4w4f. @​flavorjones
• Ensure Loofah::HTML5::Scrub.scrub_css does not decode CSS escapes in identifiers. Previously, escaped parentheses (e.g. url\28 http://example.com/\29) came out as a live url(), which could make the viewer's browser fetch an attacker-chosen URL. See GHSA-m3x9-938q-5767. @​flavorjones
• Ensure that href and xlink:href on SVG textPath and mpath elements are restricted to local (same-document) references. Previously SVG_ALLOW_LOCAL_HREF spelled textPath in lowercase, which never matched the name the HTML5 parser assigns inside <svg>, and omitted mpath entirely. See GHSA-345x-3rq2-jfrm. @​flavorjones
• Fix quadratic-time scrubbing of the href and xlink:href attributes of SVG elements. Only Ruby 3.1 and earlier are affected, because Ruby 3.2 introduced linear-time regexp matching. See GHSA-mf2j-8f84-cc9q. @​flavorjones
• Ensure HTML5 scrubber output does not turn into new markup when a browser parses it again. The fix is in Nokogiri v1.19.5, which escapes < and > in attribute values as the HTML standard requires, so Loofah now requires Nokogiri >= 1.19.5. See GHSA-h6v6-rg66-fqj4. @​flavorjones @​hackvertor

Dependencies

• Loofah now requires Ruby >= 3.2, the minimum that Nokogiri v1.19.x supports. We don't like dropping Ruby versions in a patch release, and we're sorry for the inconvenience, but it's the only way to make sure everyone gets the security fix in GHSA-h6v6-rg66-fqj4.

Added

• Loofah::HTML5::Scrub.prefixed_attribute_name and Loofah::HTML5::Scrub.scrub_attribute_value expose the html5lib attribute name and value rules, so downstream consumers can apply them instead of carrying their own copy. @​flavorjones

Fixed

• Fix :double_breakpoint, which left document fragments unchanged despite its documented example. The scrubber now changes only paragraphs inside the scrubbed node, and its run time on a document grows linearly, not quadratically, with the paragraph count. #309 @​OskarEichler
• Fix :whitewash, which passed CDATA sections through unchanged. Markup inside a CDATA section in Loofah.xml_fragment or Loofah.xml_document survived scrubbing and became live elements if the output was later parsed as HTML. The scrubber now escapes CDATA content, as :strip, :prune and :escape already do. On JRuby, every sanitizer now emits escaped CDATA content as a CDATA section, as on CRuby, instead of a text node that double-escaped it. #313 @​flavorjones (reported by @​MegaManSec)
• Fix :double_breakpoint, which raised NoMethodError on a paragraph that ends with a <br> after a double break. #314 @​flavorjones (reported by @​MegaManSec)
• Fix Loofah::HTML5::Scrub.allowed_uri?, which raised Encoding::CompatibilityError on a string in an encoding other than UTF-8 and ArgumentError on invalid UTF-8. It now transcodes the input to UTF-8 and returns false when the input has an invalid byte sequence or no UTF-8 representation. #315 @​flavorjones

Commits

• bbe007e version bump to v2.25.3
• a390863 Merge pull request #324 from flavorjones/card-933-release-v2-25-3
• 7f20aba doc: fix up CHANGELOG
• 30924ba build: require Ruby >= 3.2
• 7ba1e7b fix: require Nokogiri >= 1.19.5 to prevent mXSS in HTML5 scrubbers
• 41c681b doc: fix up CHANGELOG
• 5431ea9 doc: update CHANGELOG
• 62c0484 fix: allowed_uri? bypass via a stripped reference terminator
• ad92002 Update allowed_uri? to handle the named solidus character reference
• d3ae9eb doc: update CHANGELOG
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)