This regex by itself will not prevent XSS as you can use something like this:

```
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
```

From:  https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#META_using_data

Could we reverse the regex to only allow valid characters?