Search
Find a vulnerability
Search criteria
6 vulnerabilities found for html_sanitize_ex by rrrene
CVE-2026-68750 (GCVE-0-2026-68750)
Vulnerability from cvelistv5 – Published: 2026-08-06 14:50 – Updated: 2026-08-06 15:41
VLAI
EPSS
VEX
Title
Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service
Summary
Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the tail of a sibling list and then evaluates List.flatten([head] ++ tail) over the already flattened result, so every one of n siblings copies and re-walks the entire remaining tail. The flattening is only needed for the rare case where scrub returns several replacement nodes for one node, but the cost is paid across the whole tail at every step, making traversal quadratic in sibling count.
The traverser sits on every public entry point, so no particular scrubber or configuration is required and the payload needs only allowed tags. A 160 KB body of 20,000 sibling elements occupies a scheduler for roughly 1.7 seconds, and the cost grows faster than the body does.
This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/rrrene/html_sanitize_ex/securi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-68750.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-68750 | related |
| https://github.com/rrrene/html_sanitize_ex/commit… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| rrrene | html_sanitize_ex |
Affected:
0.3.1 , < 1.5.3
(semver)
cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:* |
|
| rrrene | html_sanitize_ex |
Affected:
69ea11d61525c470b39b6860d024770d5573ff1f , < 9f5ccedbed230930813f992a1e6906fcf485981e
(git)
cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68750",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T15:41:21.489983Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T15:41:27.813Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.HtmlSanitizeEx.Traverser\u0027",
"\u0027Elixir.HtmlSanitizeEx\u0027"
],
"packageName": "html_sanitize_ex",
"packageURL": "pkg:hex/html_sanitize_ex",
"product": "html_sanitize_ex",
"programFiles": [
"lib/html_sanitize_ex/traverser.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HtmlSanitizeEx.Traverser\u0027:traverse/2"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:basic_html/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:markdown_html/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:strip_tags/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"vendor": "rrrene",
"versions": [
{
"lessThan": "1.5.3",
"status": "affected",
"version": "0.3.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.HtmlSanitizeEx.Traverser\u0027",
"\u0027Elixir.HtmlSanitizeEx\u0027"
],
"packageName": "rrrene/html_sanitize_ex",
"packageURL": "pkg:github/rrrene/html_sanitize_ex",
"product": "html_sanitize_ex",
"programFiles": [
"lib/html_sanitize_ex/traverser.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HtmlSanitizeEx.Traverser\u0027:traverse/2"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:basic_html/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:markdown_html/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:strip_tags/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"vendor": "rrrene",
"versions": [
{
"lessThan": "9f5ccedbed230930813f992a1e6906fcf485981e",
"status": "affected",
"version": "69ea11d61525c470b39b6860d024770d5573ff1f",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.5.3",
"versionStartIncluding": "0.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ren\u00e9 F\u00f6hring"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of \u003ccode\u003eHtmlSanitizeEx.Traverser.traverse/2\u003c/code\u003e recurses on the tail of a sibling list and then evaluates \u003ccode\u003eList.flatten([head] ++ tail)\u003c/code\u003e over the already flattened result, so every one of \u003ccode\u003en\u003c/code\u003e siblings copies and re-walks the entire remaining tail. The flattening is only needed for the rare case where \u003ccode\u003escrub\u003c/code\u003e returns several replacement nodes for one node, but the cost is paid across the whole tail at every step, making traversal quadratic in sibling count.\u003c/p\u003e\n\u003cp\u003eThe traverser sits on every public entry point, so no particular scrubber or configuration is required and the payload needs only allowed tags. A 160 KB body of 20,000 sibling elements occupies a scheduler for roughly 1.7 seconds, and the cost grows faster than the body does.\u003c/p\u003e\n\u003cp\u003eThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of `HtmlSanitizeEx.Traverser.traverse/2` recurses on the tail of a sibling list and then evaluates `List.flatten([head] ++ tail)` over the already flattened result, so every one of `n` siblings copies and re-walks the entire remaining tail. The flattening is only needed for the rare case where `scrub` returns several replacement nodes for one node, but the cost is paid across the whole tail at every step, making traversal quadratic in sibling count.\n\nThe traverser sits on every public entry point, so no particular scrubber or configuration is required and the payload needs only allowed tags. A 160 KB body of 20,000 sibling elements occupies a scheduler for roughly 1.7 seconds, and the cost grows faster than the body does.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.3."
}
],
"value": "Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the tail of a sibling list and then evaluates List.flatten([head] ++ tail) over the already flattened result, so every one of n siblings copies and re-walks the entire remaining tail. The flattening is only needed for the rare case where scrub returns several replacement nodes for one node, but the cost is paid across the whole tail at every step, making traversal quadratic in sibling count.\n\nThe traverser sits on every public entry point, so no particular scrubber or configuration is required and the payload needs only allowed tags. A 160 KB body of 20,000 sibling elements occupies a scheduler for roughly 1.7 seconds, and the cost grows faster than the body does.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.3."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407 Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T14:50:20.284Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-463q-p2fr-mh9p"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-68750.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-68750"
},
{
"tags": [
"patch"
],
"url": "https://github.com/rrrene/html_sanitize_ex/commit/9f5ccedbed230930813f992a1e6906fcf485981e"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCap the size of user-supplied HTML, and in particular the node count, before it reaches the sanitizer. The quadratic growth means the cap has to be small to be effective.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Cap the size of user-supplied HTML, and in particular the node count, before it reaches the sanitizer. The quadratic growth means the cap has to be small to be effective."
}
],
"value": "Cap the size of user-supplied HTML, and in particular the node count, before it reaches the sanitizer. The quadratic growth means the cap has to be small to be effective."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-68750",
"datePublished": "2026-08-06T14:50:20.284Z",
"dateReserved": "2026-07-31T13:23:00.355Z",
"dateUpdated": "2026-08-06T15:41:27.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68749 (GCVE-0-2026-68749)
Vulnerability from cvelistv5 – Published: 2026-08-06 14:50 – Updated: 2026-08-06 15:44
VLAI
EPSS
VEX
Title
Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service
Summary
Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name with an unbounded greedy [-\w]+ followed by a mandatory :, so a long run of word characters not followed by a colon makes the engine give back one character at a time and retry the colon at every start offset. The work is quadratic in the length of the run, and no length cap is applied to the CSS handed to the scrubber. An 80 KB <style> body costs roughly 2.4 seconds of scheduler time, so a few concurrent requests saturate the BEAM scheduler pool and make the application unresponsive.
The impact is CPU exhaustion only. Nothing is read, modified or disclosed.
This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/rrrene/html_sanitize_ex/securi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-68749.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-68749 | related |
| https://github.com/rrrene/html_sanitize_ex/commit… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| rrrene | html_sanitize_ex |
Affected:
0.3.1 , < 1.5.3
(semver)
cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:* |
|
| rrrene | html_sanitize_ex |
Affected:
21f90012eb21aa36f4e3701b7547e12faf0f3c8b , < 4f4bd9eb254881462c0461fbab74b29188c2c133
(git)
cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68749",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T15:44:14.739175Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T15:44:22.358Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.HtmlSanitizeEx.Scrubber.CSS\u0027",
"\u0027Elixir.HtmlSanitizeEx\u0027"
],
"packageName": "html_sanitize_ex",
"packageURL": "pkg:hex/html_sanitize_ex",
"product": "html_sanitize_ex",
"programFiles": [
"lib/html_sanitize_ex/scrubber/css.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.CSS\u0027:scrub/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"vendor": "rrrene",
"versions": [
{
"lessThan": "1.5.3",
"status": "affected",
"version": "0.3.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.HtmlSanitizeEx.Scrubber.CSS\u0027",
"\u0027Elixir.HtmlSanitizeEx\u0027"
],
"packageName": "rrrene/html_sanitize_ex",
"packageURL": "pkg:github/rrrene/html_sanitize_ex",
"product": "html_sanitize_ex",
"programFiles": [
"lib/html_sanitize_ex/scrubber/css.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.CSS\u0027:scrub/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"vendor": "rrrene",
"versions": [
{
"lessThan": "4f4bd9eb254881462c0461fbab74b29188c2c133",
"status": "affected",
"version": "21f90012eb21aa36f4e3701b7547e12faf0f3c8b",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOnly \u003ccode\u003eHtmlSanitizeEx.html5/1\u003c/code\u003e, and custom scrubbers declared with \u003ccode\u003euse HtmlSanitizeEx, extend: :html5\u003c/code\u003e, route input into the CSS scrubber, by way of \u003ccode\u003e\u0026lt;style\u0026gt;\u003c/code\u003e element bodies and \u003ccode\u003estyle\u003c/code\u003e attributes. Applications calling \u003ccode\u003eHtmlSanitizeEx.Scrubber.CSS.scrub/1\u003c/code\u003e directly are also affected.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Only `HtmlSanitizeEx.html5/1`, and custom scrubbers declared with `use HtmlSanitizeEx, extend: :html5`, route input into the CSS scrubber, by way of `\u003cstyle\u003e` element bodies and `style` attributes. Applications calling `HtmlSanitizeEx.Scrubber.CSS.scrub/1` directly are also affected."
}
],
"value": "Only HtmlSanitizeEx.html5/1, and custom scrubbers declared with use HtmlSanitizeEx, extend: :html5, route input into the CSS scrubber, by way of \u003cstyle\u003e element bodies and style attributes. Applications calling HtmlSanitizeEx.Scrubber.CSS.scrub/1 directly are also affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.5.3",
"versionStartIncluding": "0.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ren\u00e9 F\u00f6hring"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in \u003ccode\u003eHtmlSanitizeEx.Scrubber.CSS.scrub/1\u003c/code\u003e matches the property name with an unbounded greedy \u003ccode\u003e[-\\w]+\u003c/code\u003e followed by a mandatory \u003ccode\u003e:\u003c/code\u003e, so a long run of word characters not followed by a colon makes the engine give back one character at a time and retry the colon at every start offset. The work is quadratic in the length of the run, and no length cap is applied to the CSS handed to the scrubber. An 80 KB \u003ccode\u003e\u0026lt;style\u0026gt;\u003c/code\u003e body costs roughly 2.4 seconds of scheduler time, so a few concurrent requests saturate the BEAM scheduler pool and make the application unresponsive.\u003c/p\u003e\n\u003cp\u003eThe impact is CPU exhaustion only. Nothing is read, modified or disclosed.\u003c/p\u003e\n\u003cp\u003eThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in `HtmlSanitizeEx.Scrubber.CSS.scrub/1` matches the property name with an unbounded greedy `[-\\w]+` followed by a mandatory `:`, so a long run of word characters not followed by a colon makes the engine give back one character at a time and retry the colon at every start offset. The work is quadratic in the length of the run, and no length cap is applied to the CSS handed to the scrubber. An 80 KB `\u003cstyle\u003e` body costs roughly 2.4 seconds of scheduler time, so a few concurrent requests saturate the BEAM scheduler pool and make the application unresponsive.\n\nThe impact is CPU exhaustion only. Nothing is read, modified or disclosed.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.3."
}
],
"value": "Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name with an unbounded greedy [-\\w]+ followed by a mandatory :, so a long run of word characters not followed by a colon makes the engine give back one character at a time and retry the colon at every start offset. The work is quadratic in the length of the run, and no length cap is applied to the CSS handed to the scrubber. An 80 KB \u003cstyle\u003e body costs roughly 2.4 seconds of scheduler time, so a few concurrent requests saturate the BEAM scheduler pool and make the application unresponsive.\n\nThe impact is CPU exhaustion only. Nothing is read, modified or disclosed.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.3."
}
],
"impacts": [
{
"capecId": "CAPEC-492",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-492 Regular Expression Exponential Blowup"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333 Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T14:50:12.593Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-4cx2-987x-rr2x"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-68749.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-68749"
},
{
"tags": [
"patch"
],
"url": "https://github.com/rrrene/html_sanitize_ex/commit/4f4bd9eb254881462c0461fbab74b29188c2c133"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSanitize with \u003ccode\u003ebasic_html/1\u003c/code\u003e, \u003ccode\u003emarkdown_html/1\u003c/code\u003e or \u003ccode\u003estrip_tags/1\u003c/code\u003e, none of which reach the CSS scrubber, or define a custom scrubber that allows neither \u003ccode\u003e\u0026lt;style\u0026gt;\u003c/code\u003e elements nor \u003ccode\u003estyle\u003c/code\u003e attributes.\u003c/p\u003e\n\u003cp\u003eCapping the size of user-supplied HTML before it reaches the sanitizer bounds the cost, though the quadratic growth means the cap has to be small to be effective.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Sanitize with `basic_html/1`, `markdown_html/1` or `strip_tags/1`, none of which reach the CSS scrubber, or define a custom scrubber that allows neither `\u003cstyle\u003e` elements nor `style` attributes.\n\nCapping the size of user-supplied HTML before it reaches the sanitizer bounds the cost, though the quadratic growth means the cap has to be small to be effective."
}
],
"value": "Sanitize with basic_html/1, markdown_html/1 or strip_tags/1, none of which reach the CSS scrubber, or define a custom scrubber that allows neither \u003cstyle\u003e elements nor style attributes.\n\nCapping the size of user-supplied HTML before it reaches the sanitizer bounds the cost, though the quadratic growth means the cap has to be small to be effective."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-68749",
"datePublished": "2026-08-06T14:50:12.593Z",
"dateReserved": "2026-07-31T13:23:00.355Z",
"dateUpdated": "2026-08-06T15:44:22.358Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68747 (GCVE-0-2026-68747)
Vulnerability from cvelistv5 – Published: 2026-08-06 14:50 – Updated: 2026-08-06 15:43
VLAI
EPSS
VEX
Title
CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input
Summary
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed.
Element boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes.
This issue affects html_sanitize_ex: from 0.3.1 before 1.5.4.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/rrrene/html_sanitize_ex/securi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-68747.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-68747 | related |
| https://github.com/rrrene/html_sanitize_ex/commit… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| rrrene | html_sanitize_ex |
Affected:
0.3.1 , < 1.5.4
(semver)
cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:* |
|
| rrrene | html_sanitize_ex |
Affected:
21f90012eb21aa36f4e3701b7547e12faf0f3c8b , < 0b9f9ad63a7529d4f2c3c1134c371adc3e654308
(git)
cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68747",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T15:43:31.189847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T15:43:37.237Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.HtmlSanitizeEx.Scrubber.CSS\u0027",
"\u0027Elixir.HtmlSanitizeEx\u0027"
],
"packageName": "html_sanitize_ex",
"packageURL": "pkg:hex/html_sanitize_ex",
"product": "html_sanitize_ex",
"programFiles": [
"lib/html_sanitize_ex/scrubber/css.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.CSS\u0027:scrub/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"vendor": "rrrene",
"versions": [
{
"lessThan": "1.5.4",
"status": "affected",
"version": "0.3.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.HtmlSanitizeEx.Scrubber.CSS\u0027",
"\u0027Elixir.HtmlSanitizeEx\u0027"
],
"packageName": "rrrene/html_sanitize_ex",
"packageURL": "pkg:github/rrrene/html_sanitize_ex",
"product": "html_sanitize_ex",
"programFiles": [
"lib/html_sanitize_ex/scrubber/css.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.CSS\u0027:scrub/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"vendor": "rrrene",
"versions": [
{
"lessThan": "0b9f9ad63a7529d4f2c3c1134c371adc3e654308",
"status": "affected",
"version": "21f90012eb21aa36f4e3701b7547e12faf0f3c8b",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOnly \u003ccode\u003eHtmlSanitizeEx.html5/1\u003c/code\u003e, and custom scrubbers declared with \u003ccode\u003euse HtmlSanitizeEx, extend: :html5\u003c/code\u003e, permit \u003ccode\u003e\u0026lt;style\u0026gt;\u003c/code\u003e elements, and the sanitized output must be rendered to other users. Applications calling \u003ccode\u003eHtmlSanitizeEx.Scrubber.CSS.scrub/1\u003c/code\u003e directly are also affected.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Only `HtmlSanitizeEx.html5/1`, and custom scrubbers declared with `use HtmlSanitizeEx, extend: :html5`, permit `\u003cstyle\u003e` elements, and the sanitized output must be rendered to other users. Applications calling `HtmlSanitizeEx.Scrubber.CSS.scrub/1` directly are also affected."
}
],
"value": "Only HtmlSanitizeEx.html5/1, and custom scrubbers declared with use HtmlSanitizeEx, extend: :html5, permit \u003cstyle\u003e elements, and the sanitized output must be rendered to other users. Applications calling HtmlSanitizeEx.Scrubber.CSS.scrub/1 directly are also affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.5.4",
"versionStartIncluding": "0.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ren\u00e9 F\u00f6hring"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027) vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. \u003ccode\u003eHtmlSanitizeEx.Scrubber.CSS.scrub/1\u003c/code\u003e applies its property and value allowlist through a \u003ccode\u003eRegex.replace\u003c/code\u003e over substrings matching a \u003ccode\u003eproperty: value\u003c/code\u003e declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. \u003ccode\u003e@import url(//attacker.example/style.css);\u003c/code\u003e survives, while the same URL inside a \u003ccode\u003ebackground: url(...)\u003c/code\u003e declaration is removed.\u003c/p\u003e\n\u003cp\u003eElement boundaries are resolved before the scrubber runs, so injected content does not escape the \u003ccode\u003e\u0026lt;style\u0026gt;\u003c/code\u003e element and no script executes.\u003c/p\u003e\n\u003cp\u003eThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.4.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027) vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. `HtmlSanitizeEx.Scrubber.CSS.scrub/1` applies its property and value allowlist through a `Regex.replace` over substrings matching a `property: value` declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. `@import url(//attacker.example/style.css);` survives, while the same URL inside a `background: url(...)` declaration is removed.\n\nElement boundaries are resolved before the scrubber runs, so injected content does not escape the `\u003cstyle\u003e` element and no script executes.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.4."
}
],
"value": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027) vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed.\n\nElement boundaries are resolved before the scrubber runs, so injected content does not escape the \u003cstyle\u003e element and no script executes.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.4."
}
],
"impacts": [
{
"capecId": "CAPEC-148",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-148 Content Spoofing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T15:08:58.171Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-87v2-pfhj-r5x7"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-68747.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-68747"
},
{
"tags": [
"patch"
],
"url": "https://github.com/rrrene/html_sanitize_ex/commit/0b9f9ad63a7529d4f2c3c1134c371adc3e654308"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSanitize with \u003ccode\u003ebasic_html/1\u003c/code\u003e, \u003ccode\u003emarkdown_html/1\u003c/code\u003e or \u003ccode\u003estrip_tags/1\u003c/code\u003e, none of which allow \u003ccode\u003e\u0026lt;style\u0026gt;\u003c/code\u003e elements, or define a custom scrubber that omits it.\u003c/p\u003e\n\u003cp\u003eA Content-Security-Policy \u003ccode\u003estyle-src\u003c/code\u003e directive that permits no external stylesheet origins stops an injected \u003ccode\u003e@import\u003c/code\u003e from loading, though injected inline rules still apply.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Sanitize with `basic_html/1`, `markdown_html/1` or `strip_tags/1`, none of which allow `\u003cstyle\u003e` elements, or define a custom scrubber that omits it.\n\nA Content-Security-Policy `style-src` directive that permits no external stylesheet origins stops an injected `@import` from loading, though injected inline rules still apply."
}
],
"value": "Sanitize with basic_html/1, markdown_html/1 or strip_tags/1, none of which allow \u003cstyle\u003e elements, or define a custom scrubber that omits it.\n\nA Content-Security-Policy style-src directive that permits no external stylesheet origins stops an injected @import from loading, though injected inline rules still apply."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-68747",
"datePublished": "2026-08-06T14:50:03.143Z",
"dateReserved": "2026-07-31T13:23:00.355Z",
"dateUpdated": "2026-08-06T15:43:37.237Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66829 (GCVE-0-2026-66829)
Vulnerability from cvelistv5 – Published: 2026-08-06 14:49 – Updated: 2026-08-06 15:42
VLAI
EPSS
VEX
Title
html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection
Summary
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a <meta http-equiv="refresh"> element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied <meta> elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy.
This is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated.
This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/rrrene/html_sanitize_ex/securi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-66829.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-66829 | related |
| https://github.com/rrrene/html_sanitize_ex/commit… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| rrrene | html_sanitize_ex |
Affected:
0.3.1 , < 1.5.3
(semver)
cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:* |
|
| rrrene | html_sanitize_ex |
Affected:
8976d64ea0b77d26093a94a43ec48a3978e8d028 , < 9f7e38be51edc38f132dfe994f37af5cf5e0e76f
(git)
cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66829",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T15:42:40.366099Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T15:42:46.200Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.HtmlSanitizeEx.Scrubber.HTML5",
"Elixir.HtmlSanitizeEx"
],
"packageName": "html_sanitize_ex",
"packageURL": "pkg:hex/html_sanitize_ex",
"product": "html_sanitize_ex",
"programFiles": [
"lib/html_sanitize_ex/scrubber/html5.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:scrub_attribute/2"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:sanitize/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"vendor": "rrrene",
"versions": [
{
"lessThan": "1.5.3",
"status": "affected",
"version": "0.3.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.HtmlSanitizeEx.Scrubber.HTML5",
"Elixir.HtmlSanitizeEx"
],
"packageName": "rrrene/html_sanitize_ex",
"packageURL": "pkg:github/rrrene/html_sanitize_ex",
"product": "html_sanitize_ex",
"programFiles": [
"lib/html_sanitize_ex/scrubber/html5.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:scrub_attribute/2"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:sanitize/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"vendor": "rrrene",
"versions": [
{
"lessThan": "9f7e38be51edc38f132dfe994f37af5cf5e0e76f",
"status": "affected",
"version": "8976d64ea0b77d26093a94a43ec48a3978e8d028",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOnly \u003ccode\u003eHtmlSanitizeEx.html5/1\u003c/code\u003e, and custom scrubbers declared with \u003ccode\u003euse HtmlSanitizeEx, extend: :html5\u003c/code\u003e, allow the \u003ccode\u003emeta\u003c/code\u003e element, and the sanitized output must be rendered to other users.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Only `HtmlSanitizeEx.html5/1`, and custom scrubbers declared with `use HtmlSanitizeEx, extend: :html5`, allow the `meta` element, and the sanitized output must be rendered to other users."
}
],
"value": "Only HtmlSanitizeEx.html5/1, and custom scrubbers declared with use HtmlSanitizeEx, extend: :html5, allow the meta element, and the sanitized output must be rendered to other users."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.5.3",
"versionStartIncluding": "0.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ren\u00e9 F\u00f6hring"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eURL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker\u0027s choosing via a \u003ccode\u003e\u0026lt;meta http-equiv=\"refresh\"\u0026gt;\u003c/code\u003e element in sanitized HTML. \u003ccode\u003eHtmlSanitizeEx.html5/1\u003c/code\u003e keeps attacker-supplied \u003ccode\u003e\u0026lt;meta\u0026gt;\u003c/code\u003e elements in its output. A \u003ccode\u003emeta\u003c/code\u003e element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as \u003ccode\u003eContent-Security-Policy\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis is not cross-site scripting. Browsers do not navigate a meta refresh to a \u003ccode\u003ejavascript:\u003c/code\u003e URL, so the uppercase \u003ccode\u003eJAVASCRIPT:\u003c/code\u003e filter bypass yields no script execution and none was demonstrated.\u003c/p\u003e\n\u003cp\u003eThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker\u0027s choosing via a `\u003cmeta http-equiv=\"refresh\"\u003e` element in sanitized HTML. `HtmlSanitizeEx.html5/1` keeps attacker-supplied `\u003cmeta\u003e` elements in its output. A `meta` element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as `Content-Security-Policy`.\n\nThis is not cross-site scripting. Browsers do not navigate a meta refresh to a `javascript:` URL, so the uppercase `JAVASCRIPT:` filter bypass yields no script execution and none was demonstrated.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.3."
}
],
"value": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker\u0027s choosing via a \u003cmeta http-equiv=\"refresh\"\u003e element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied \u003cmeta\u003e elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy.\n\nThis is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.3."
}
],
"impacts": [
{
"capecId": "CAPEC-154",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-154 Resource Location Spoofing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T14:49:23.468Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-2c6f-3j54-xpcr"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-66829.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-66829"
},
{
"tags": [
"patch"
],
"url": "https://github.com/rrrene/html_sanitize_ex/commit/9f7e38be51edc38f132dfe994f37af5cf5e0e76f"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSanitize with \u003ccode\u003ebasic_html/1\u003c/code\u003e, \u003ccode\u003emarkdown_html/1\u003c/code\u003e or \u003ccode\u003estrip_tags/1\u003c/code\u003e, none of which allow \u003ccode\u003emeta\u003c/code\u003e, or define a custom scrubber that omits it.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Sanitize with `basic_html/1`, `markdown_html/1` or `strip_tags/1`, none of which allow `meta`, or define a custom scrubber that omits it."
}
],
"value": "Sanitize with basic_html/1, markdown_html/1 or strip_tags/1, none of which allow meta, or define a custom scrubber that omits it."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-66829",
"datePublished": "2026-08-06T14:49:23.468Z",
"dateReserved": "2026-08-06T08:15:02.719Z",
"dateUpdated": "2026-08-06T15:42:46.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66370 (GCVE-0-2026-66370)
Vulnerability from cvelistv5 – Published: 2026-08-06 14:49 – Updated: 2026-08-06 15:42
VLAI
EPSS
VEX
Title
html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking
Summary
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction attributes on an <input> element in sanitized HTML. HTML's form attribute associates an input with any form on the page by its id even when the input sits outside that form, and formaction on a submit control overrides the owning form's action. Neither attribute receives a scheme check, so an absolute cross-origin URL survives sanitizing.
No script executes. The scrubber allows neither form nor button, so the attacker cannot introduce a form of their own and the rendering page must already contain a form carrying an id.
This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/rrrene/html_sanitize_ex/securi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-66370.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-66370 | related |
| https://github.com/rrrene/html_sanitize_ex/commit… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| rrrene | html_sanitize_ex |
Affected:
0.3.1 , < 1.5.3
(semver)
cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:* |
|
| rrrene | html_sanitize_ex |
Affected:
8976d64ea0b77d26093a94a43ec48a3978e8d028 , < a1e804ed997e780ea71d14393cf2f701330553a6
(git)
cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66370",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T15:42:03.803831Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T15:42:09.603Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.HtmlSanitizeEx.Scrubber.HTML5",
"Elixir.HtmlSanitizeEx"
],
"packageName": "html_sanitize_ex",
"packageURL": "pkg:hex/html_sanitize_ex",
"product": "html_sanitize_ex",
"programFiles": [
"lib/html_sanitize_ex/scrubber/html5.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:scrub_attribute/2"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:sanitize/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"vendor": "rrrene",
"versions": [
{
"lessThan": "1.5.3",
"status": "affected",
"version": "0.3.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.HtmlSanitizeEx.Scrubber.HTML5",
"Elixir.HtmlSanitizeEx"
],
"packageName": "rrrene/html_sanitize_ex",
"packageURL": "pkg:github/rrrene/html_sanitize_ex",
"product": "html_sanitize_ex",
"programFiles": [
"lib/html_sanitize_ex/scrubber/html5.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:scrub_attribute/2"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:sanitize/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"vendor": "rrrene",
"versions": [
{
"lessThan": "a1e804ed997e780ea71d14393cf2f701330553a6",
"status": "affected",
"version": "8976d64ea0b77d26093a94a43ec48a3978e8d028",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOnly \u003ccode\u003eHtmlSanitizeEx.html5/1\u003c/code\u003e, and custom scrubbers declared with \u003ccode\u003euse HtmlSanitizeEx, extend: :html5\u003c/code\u003e, allow the \u003ccode\u003einput\u003c/code\u003e element, and the sanitized output must be rendered to other users.\u003c/p\u003e\n\u003cp\u003eThe rendering page must also contain a form with an \u003ccode\u003eid\u003c/code\u003e, since that \u003ccode\u003eid\u003c/code\u003e is what the injected \u003ccode\u003eform\u003c/code\u003e attribute binds to.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Only `HtmlSanitizeEx.html5/1`, and custom scrubbers declared with `use HtmlSanitizeEx, extend: :html5`, allow the `input` element, and the sanitized output must be rendered to other users.\n\nThe rendering page must also contain a form with an `id`, since that `id` is what the injected `form` attribute binds to."
}
],
"value": "Only HtmlSanitizeEx.html5/1, and custom scrubbers declared with use HtmlSanitizeEx, extend: :html5, allow the input element, and the sanitized output must be rendered to other users.\n\nThe rendering page must also contain a form with an id, since that id is what the injected form attribute binds to."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.5.3",
"versionStartIncluding": "0.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ren\u00e9 F\u00f6hring"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eURL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the \u003ccode\u003eform\u003c/code\u003e and \u003ccode\u003eformaction\u003c/code\u003e attributes on an \u003ccode\u003e\u0026lt;input\u0026gt;\u003c/code\u003e element in sanitized HTML. HTML\u0027s \u003ccode\u003eform\u003c/code\u003e attribute associates an input with any form on the page by its \u003ccode\u003eid\u003c/code\u003e even when the input sits outside that form, and \u003ccode\u003eformaction\u003c/code\u003e on a submit control overrides the owning form\u0027s \u003ccode\u003eaction\u003c/code\u003e. Neither attribute receives a scheme check, so an absolute cross-origin URL survives sanitizing.\u003c/p\u003e\n\u003cp\u003eNo script executes. The scrubber allows neither \u003ccode\u003eform\u003c/code\u003e nor \u003ccode\u003ebutton\u003c/code\u003e, so the attacker cannot introduce a form of their own and the rendering page must already contain a form carrying an \u003ccode\u003eid\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the `form` and `formaction` attributes on an `\u003cinput\u003e` element in sanitized HTML. HTML\u0027s `form` attribute associates an input with any form on the page by its `id` even when the input sits outside that form, and `formaction` on a submit control overrides the owning form\u0027s `action`. Neither attribute receives a scheme check, so an absolute cross-origin URL survives sanitizing.\n\nNo script executes. The scrubber allows neither `form` nor `button`, so the attacker cannot introduce a form of their own and the rendering page must already contain a form carrying an `id`.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.3."
}
],
"value": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction attributes on an \u003cinput\u003e element in sanitized HTML. HTML\u0027s form attribute associates an input with any form on the page by its id even when the input sits outside that form, and formaction on a submit control overrides the owning form\u0027s action. Neither attribute receives a scheme check, so an absolute cross-origin URL survives sanitizing.\n\nNo script executes. The scrubber allows neither form nor button, so the attacker cannot introduce a form of their own and the rendering page must already contain a form carrying an id.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.3."
}
],
"impacts": [
{
"capecId": "CAPEC-154",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-154 Resource Location Spoofing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T14:49:15.841Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-w3f9-jjhw-wwvq"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-66370.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-66370"
},
{
"tags": [
"patch"
],
"url": "https://github.com/rrrene/html_sanitize_ex/commit/a1e804ed997e780ea71d14393cf2f701330553a6"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSanitize with \u003ccode\u003ebasic_html/1\u003c/code\u003e, \u003ccode\u003emarkdown_html/1\u003c/code\u003e or \u003ccode\u003estrip_tags/1\u003c/code\u003e, none of which allow \u003ccode\u003einput\u003c/code\u003e, or define a custom scrubber that omits it.\u003c/p\u003e\n\u003cp\u003eOmitting the \u003ccode\u003eid\u003c/code\u003e attribute from the page\u0027s own forms, or giving them values an attacker cannot predict, removes the anchor the injected \u003ccode\u003eform\u003c/code\u003e attribute needs.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Sanitize with `basic_html/1`, `markdown_html/1` or `strip_tags/1`, none of which allow `input`, or define a custom scrubber that omits it.\n\nOmitting the `id` attribute from the page\u0027s own forms, or giving them values an attacker cannot predict, removes the anchor the injected `form` attribute needs."
}
],
"value": "Sanitize with basic_html/1, markdown_html/1 or strip_tags/1, none of which allow input, or define a custom scrubber that omits it.\n\nOmitting the id attribute from the page\u0027s own forms, or giving them values an attacker cannot predict, removes the anchor the injected form attribute needs."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-66370",
"datePublished": "2026-08-06T14:49:15.841Z",
"dateReserved": "2026-08-06T10:15:01.808Z",
"dateUpdated": "2026-08-06T15:42:09.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66843 (GCVE-0-2026-66843)
Vulnerability from cvelistv5 – Published: 2026-08-06 14:48 – Updated: 2026-08-06 15:40
VLAI
EPSS
VEX
Title
html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding
Summary
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive.
This is not unconditional cross-site scripting. A javascript: URL does not execute through <object data> in current browsers, data: documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path.
This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/rrrene/html_sanitize_ex/securi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-66843.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-66843 | related |
| https://github.com/rrrene/html_sanitize_ex/commit… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| rrrene | html_sanitize_ex |
Affected:
0.3.1 , < 1.5.3
(semver)
cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:* |
|
| rrrene | html_sanitize_ex |
Affected:
8976d64ea0b77d26093a94a43ec48a3978e8d028 , < bec27fec4de99e40c68c4285a610e09e791a3eaf
(git)
cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66843",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T15:40:41.682905Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T15:40:50.570Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.HtmlSanitizeEx.Scrubber.HTML5",
"Elixir.HtmlSanitizeEx"
],
"packageName": "html_sanitize_ex",
"packageURL": "pkg:hex/html_sanitize_ex",
"product": "html_sanitize_ex",
"programFiles": [
"lib/html_sanitize_ex/scrubber/html5.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:scrub_attribute/2"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:sanitize/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"vendor": "rrrene",
"versions": [
{
"lessThan": "1.5.3",
"status": "affected",
"version": "0.3.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.HtmlSanitizeEx.Scrubber.HTML5",
"Elixir.HtmlSanitizeEx"
],
"packageName": "rrrene/html_sanitize_ex",
"packageURL": "pkg:github/rrrene/html_sanitize_ex",
"product": "html_sanitize_ex",
"programFiles": [
"lib/html_sanitize_ex/scrubber/html5.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:scrub_attribute/2"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:sanitize/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"vendor": "rrrene",
"versions": [
{
"lessThan": "bec27fec4de99e40c68c4285a610e09e791a3eaf",
"status": "affected",
"version": "8976d64ea0b77d26093a94a43ec48a3978e8d028",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOnly \u003ccode\u003eHtmlSanitizeEx.html5/1\u003c/code\u003e, and custom scrubbers declared with \u003ccode\u003euse HtmlSanitizeEx, extend: :html5\u003c/code\u003e, allow the \u003ccode\u003eobject\u003c/code\u003e element, and the sanitized output must be rendered to other users.\u003c/p\u003e\n\u003cp\u003eScript execution in the host origin additionally requires the application to serve attacker-controlled HTML from a same-origin path, such as an uploads directory served as \u003ccode\u003etext/html\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Only `HtmlSanitizeEx.html5/1`, and custom scrubbers declared with `use HtmlSanitizeEx, extend: :html5`, allow the `object` element, and the sanitized output must be rendered to other users.\n\nScript execution in the host origin additionally requires the application to serve attacker-controlled HTML from a same-origin path, such as an uploads directory served as `text/html`."
}
],
"value": "Only HtmlSanitizeEx.html5/1, and custom scrubbers declared with use HtmlSanitizeEx, extend: :html5, allow the object element, and the sanitized output must be rendered to other users.\n\nScript execution in the host origin additionally requires the application to serve attacker-controlled HTML from a same-origin path, such as an uploads directory served as text/html."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.5.3",
"versionStartIncluding": "0.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ren\u00e9 F\u00f6hring"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the \u003ccode\u003edata\u003c/code\u003e attribute of an \u003ccode\u003e\u0026lt;object\u0026gt;\u003c/code\u003e element in sanitized HTML. \u003ccode\u003eobject\u003c/code\u003e is the one URI-bearing element in \u003ccode\u003elib/html_sanitize_ex/scrubber/html5.ex\u003c/code\u003e never registered through \u003ccode\u003eallow_tag_with_uri_attributes/3\u003c/code\u003e, and its only guard is a prefix match on lowercase \u003ccode\u003e\"javascript:\"\u003c/code\u003e, so mixed-case variants, \u003ccode\u003edata:\u003c/code\u003e URIs, protocol-relative URLs and same-origin paths all survive.\u003c/p\u003e\n\u003cp\u003eThis is not unconditional cross-site scripting. A \u003ccode\u003ejavascript:\u003c/code\u003e URL does not execute through \u003ccode\u003e\u0026lt;object data\u0026gt;\u003c/code\u003e in current browsers, \u003ccode\u003edata:\u003c/code\u003e documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path.\u003c/p\u003e\n\u003cp\u003eThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the `data` attribute of an `\u003cobject\u003e` element in sanitized HTML. `object` is the one URI-bearing element in `lib/html_sanitize_ex/scrubber/html5.ex` never registered through `allow_tag_with_uri_attributes/3`, and its only guard is a prefix match on lowercase `\"javascript:\"`, so mixed-case variants, `data:` URIs, protocol-relative URLs and same-origin paths all survive.\n\nThis is not unconditional cross-site scripting. A `javascript:` URL does not execute through `\u003cobject data\u003e` in current browsers, `data:` documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.3."
}
],
"value": "Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an \u003cobject\u003e element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase \"javascript:\", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive.\n\nThis is not unconditional cross-site scripting. A javascript: URL does not execute through \u003cobject data\u003e in current browsers, data: documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.3."
}
],
"impacts": [
{
"capecId": "CAPEC-175",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-175 Code Inclusion"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T14:48:20.513Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-xmm9-jc22-rcgj"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-66843.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-66843"
},
{
"tags": [
"patch"
],
"url": "https://github.com/rrrene/html_sanitize_ex/commit/bec27fec4de99e40c68c4285a610e09e791a3eaf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "html_sanitize_ex HTML5 scrubber keeps attacker-supplied `\u003cobject\u003e` elements, allowing untrusted content embedding",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSanitize with \u003ccode\u003ebasic_html/1\u003c/code\u003e, \u003ccode\u003emarkdown_html/1\u003c/code\u003e or \u003ccode\u003estrip_tags/1\u003c/code\u003e, none of which allow \u003ccode\u003eobject\u003c/code\u003e, or define a custom scrubber that omits it.\u003c/p\u003e\n\u003cp\u003eA Content-Security-Policy of \u003ccode\u003eobject-src \u0027none\u0027\u003c/code\u003e blocks an injected \u003ccode\u003e\u0026lt;object\u0026gt;\u003c/code\u003e from loading, and hosting user uploads on a separate origin removes the escalation path.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Sanitize with `basic_html/1`, `markdown_html/1` or `strip_tags/1`, none of which allow `object`, or define a custom scrubber that omits it.\n\nA Content-Security-Policy of `object-src \u0027none\u0027` blocks an injected `\u003cobject\u003e` from loading, and hosting user uploads on a separate origin removes the escalation path."
}
],
"value": "Sanitize with basic_html/1, markdown_html/1 or strip_tags/1, none of which allow object, or define a custom scrubber that omits it.\n\nA Content-Security-Policy of object-src \u0027none\u0027 blocks an injected \u003cobject\u003e from loading, and hosting user uploads on a separate origin removes the escalation path."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-66843",
"datePublished": "2026-08-06T14:48:20.513Z",
"dateReserved": "2026-08-06T09:00:01.259Z",
"dateUpdated": "2026-08-06T15:40:50.570Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}