GHSA-P9WJ-W8XQ-VJX6 Loofah allowed_uri? treats javascript&#x3a alert(1) as safe

Summary Loofah::HTML5::Scrub.alloweduri? returns true for a javascript: or vbscript: URI whose scheme is split by a numeric character reference without a trailing semicolon, followed by a character that alloweduri? strips, such as a space or tab. A browser ends the reference at that character and...