CVE-2026-66829 (GCVE-0-2026-66829)
Vulnerability from cvelistv5 – Published: 2026-08-06 14:49 – Updated: 2026-08-19 11:50
VLAI
EPSS
VEX
Title
html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection
Summary
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a <meta http-equiv="refresh"> element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied <meta> elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy.
This is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated.
This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 15:42 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/rrrene/html_sanitize_ex/securi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-66829.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-66829 | related |
| https://github.com/rrrene/html_sanitize_ex/commit… | patch |
| https://github.com/rrrene/html_sanitize_ex/commit… | patch |
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| rrrene | html_sanitize_ex |
Affected:
0.3.1 , < 1.4.5
(semver)
Affected: 1.5.0-rc.0 , < 1.5.3 (semver) cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:* |
||
| rrrene | html_sanitize_ex |
Affected:
8976d64ea0b77d26093a94a43ec48a3978e8d028 , < *
(git)
cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66829",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T15:42:40.366099Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T15:42:46.200Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.HtmlSanitizeEx.Scrubber.HTML5",
"Elixir.HtmlSanitizeEx"
],
"packageName": "html_sanitize_ex",
"packageURL": "pkg:hex/html_sanitize_ex",
"product": "html_sanitize_ex",
"programFiles": [
"lib/html_sanitize_ex/scrubber/html5.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:scrub_attribute/2"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:sanitize/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"vendor": "rrrene",
"versions": [
{
"lessThan": "1.4.5",
"status": "affected",
"version": "0.3.1",
"versionType": "semver"
},
{
"lessThan": "1.5.3",
"status": "affected",
"version": "1.5.0-rc.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.HtmlSanitizeEx.Scrubber.HTML5",
"Elixir.HtmlSanitizeEx"
],
"packageName": "rrrene/html_sanitize_ex",
"packageURL": "pkg:github/rrrene/html_sanitize_ex",
"product": "html_sanitize_ex",
"programFiles": [
"lib/html_sanitize_ex/scrubber/html5.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:scrub_attribute/2"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:sanitize/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"vendor": "rrrene",
"versions": [
{
"changes": [
{
"at": "9f7e38be51edc38f132dfe994f37af5cf5e0e76f",
"status": "unaffected"
},
{
"at": "29454dc99513fd9b5b6429ab7b6695ad09889227",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "8976d64ea0b77d26093a94a43ec48a3978e8d028",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOnly \u003ccode\u003eHtmlSanitizeEx.html5/1\u003c/code\u003e, and custom scrubbers declared with \u003ccode\u003euse HtmlSanitizeEx, extend: :html5\u003c/code\u003e, allow the \u003ccode\u003emeta\u003c/code\u003e element, and the sanitized output must be rendered to other users.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Only `HtmlSanitizeEx.html5/1`, and custom scrubbers declared with `use HtmlSanitizeEx, extend: :html5`, allow the `meta` element, and the sanitized output must be rendered to other users."
}
],
"value": "Only HtmlSanitizeEx.html5/1, and custom scrubbers declared with use HtmlSanitizeEx, extend: :html5, allow the meta element, and the sanitized output must be rendered to other users."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.5",
"versionStartIncluding": "0.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.5.3",
"versionStartIncluding": "1.5.0-rc.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ren\u00e9 F\u00f6hring"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eURL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker\u0027s choosing via a \u003ccode\u003e\u0026lt;meta http-equiv=\"refresh\"\u0026gt;\u003c/code\u003e element in sanitized HTML. \u003ccode\u003eHtmlSanitizeEx.html5/1\u003c/code\u003e keeps attacker-supplied \u003ccode\u003e\u0026lt;meta\u0026gt;\u003c/code\u003e elements in its output. A \u003ccode\u003emeta\u003c/code\u003e element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as \u003ccode\u003eContent-Security-Policy\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis is not cross-site scripting. Browsers do not navigate a meta refresh to a \u003ccode\u003ejavascript:\u003c/code\u003e URL, so the uppercase \u003ccode\u003eJAVASCRIPT:\u003c/code\u003e filter bypass yields no script execution and none was demonstrated.\u003c/p\u003e\n\u003cp\u003eThis issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker\u0027s choosing via a `\u003cmeta http-equiv=\"refresh\"\u003e` element in sanitized HTML. `HtmlSanitizeEx.html5/1` keeps attacker-supplied `\u003cmeta\u003e` elements in its output. A `meta` element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as `Content-Security-Policy`.\n\nThis is not cross-site scripting. Browsers do not navigate a meta refresh to a `javascript:` URL, so the uppercase `JAVASCRIPT:` filter bypass yields no script execution and none was demonstrated.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3."
}
],
"value": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker\u0027s choosing via a \u003cmeta http-equiv=\"refresh\"\u003e element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied \u003cmeta\u003e elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy.\n\nThis is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3."
}
],
"impacts": [
{
"capecId": "CAPEC-154",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-154 Resource Location Spoofing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T11:50:39.885Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-2c6f-3j54-xpcr"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-66829.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-66829"
},
{
"tags": [
"patch"
],
"url": "https://github.com/rrrene/html_sanitize_ex/commit/9f7e38be51edc38f132dfe994f37af5cf5e0e76f"
},
{
"tags": [
"patch"
],
"url": "https://github.com/rrrene/html_sanitize_ex/commit/29454dc99513fd9b5b6429ab7b6695ad09889227"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSanitize with \u003ccode\u003ebasic_html/1\u003c/code\u003e, \u003ccode\u003emarkdown_html/1\u003c/code\u003e or \u003ccode\u003estrip_tags/1\u003c/code\u003e, none of which allow \u003ccode\u003emeta\u003c/code\u003e, or define a custom scrubber that omits it.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Sanitize with `basic_html/1`, `markdown_html/1` or `strip_tags/1`, none of which allow `meta`, or define a custom scrubber that omits it."
}
],
"value": "Sanitize with basic_html/1, markdown_html/1 or strip_tags/1, none of which allow meta, or define a custom scrubber that omits it."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-66829",
"datePublished": "2026-08-06T14:49:23.468Z",
"dateReserved": "2026-08-06T08:15:02.719Z",
"dateUpdated": "2026-08-19T11:50:39.885Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-66829",
"date": "2026-10-23",
"epss": "0.00566",
"percentile": "0.46286"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.HtmlSanitizeEx.Scrubber.HTML5",
"Elixir.HtmlSanitizeEx"
],
"packageName": "html_sanitize_ex",
"packageURL": "pkg:hex/html_sanitize_ex",
"product": "html_sanitize_ex",
"programFiles": [
"lib/html_sanitize_ex/scrubber/html5.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:scrub_attribute/2"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:sanitize/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"vendor": "rrrene",
"versions": [
{
"lessThan": "1.4.5",
"status": "affected",
"version": "0.3.1",
"versionType": "semver"
},
{
"lessThan": "1.5.3",
"status": "affected",
"version": "1.5.0-rc.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.HtmlSanitizeEx.Scrubber.HTML5",
"Elixir.HtmlSanitizeEx"
],
"packageName": "rrrene/html_sanitize_ex",
"packageURL": "pkg:github/rrrene/html_sanitize_ex",
"product": "html_sanitize_ex",
"programFiles": [
"lib/html_sanitize_ex/scrubber/html5.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:scrub_attribute/2"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:sanitize/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"vendor": "rrrene",
"versions": [
{
"changes": [
{
"at": "9f7e38be51edc38f132dfe994f37af5cf5e0e76f",
"status": "unaffected"
},
{
"at": "29454dc99513fd9b5b6429ab7b6695ad09889227",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "8976d64ea0b77d26093a94a43ec48a3978e8d028",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rrrene:htmlsanitizeex:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DE85053C-AE84-4570-A90C-4D4CCD7A4BA3",
"versionEndExcluding": "1.5.3",
"versionStartIncluding": "0.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker\u0027s choosing via a \u003cmeta http-equiv=\"refresh\"\u003e element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied \u003cmeta\u003e elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy.\n\nThis is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3."
},
{
"lang": "es",
"value": "La vulnerabilidad de redirecci\u00f3n de URL a sitio no confiable (\u2019redirecci\u00f3n abierta\u2019) en el depurador HTML5 de rrrene html_sanitize_ex permite a un atacante remoto forzar a los visitantes de una p\u00e1gina a navegar a un sitio elegido por el atacante a trav\u00e9s de un elemento \u003cmeta http-equiv=\u201crefresh\u201d\u003e en HTML saneado. HtmlSanitizeEx.html5/1 mantiene los elementos [meta] proporcionados por el atacante en su salida. Un elemento meta act\u00faa sobre todo el documento en lugar de sobre el fragmento en el que fue incrustado, por lo que tambi\u00e9n puede declarar directivas a nivel de documento como Content-Security-Policy.\n\nEsto no es cross-site scripting. Los navegadores no navegan una meta refresh a una URL javascript_disabled: , por lo que el bypass del filtro javascript_disabled: en may\u00fasculas no produce ejecuci\u00f3n de script y no se demostr\u00f3 ninguna.\n\nEste problema afecta a html_sanitize_ex: desde 0.3.1 antes de 1.5.3."
}
],
"id": "CVE-2026-66829",
"lastModified": "2026-10-23T21:10:00.157",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 2.3,
"baseSeverity": "LOW",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-66829",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T15:42:40.366099Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-06T16:16:49.450",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-66829.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/rrrene/html_sanitize_ex/commit/29454dc99513fd9b5b6429ab7b6695ad09889227"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch"
],
"url": "https://github.com/rrrene/html_sanitize_ex/commit/9f7e38be51edc38f132dfe994f37af5cf5e0e76f"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Broken Link"
],
"url": "https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-2c6f-3j54-xpcr"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-66829"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-601"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66829",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T15:42:40.366099Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T15:42:42.992Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.HtmlSanitizeEx.Scrubber.HTML5",
"Elixir.HtmlSanitizeEx"
],
"packageName": "html_sanitize_ex",
"packageURL": "pkg:hex/html_sanitize_ex",
"product": "html_sanitize_ex",
"programFiles": [
"lib/html_sanitize_ex/scrubber/html5.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:scrub_attribute/2"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:sanitize/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"vendor": "rrrene",
"versions": [
{
"lessThan": "1.4.5",
"status": "affected",
"version": "0.3.1",
"versionType": "semver"
},
{
"lessThan": "1.5.3",
"status": "affected",
"version": "1.5.0-rc.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Elixir.HtmlSanitizeEx.Scrubber.HTML5",
"Elixir.HtmlSanitizeEx"
],
"packageName": "rrrene/html_sanitize_ex",
"packageURL": "pkg:github/rrrene/html_sanitize_ex",
"product": "html_sanitize_ex",
"programFiles": [
"lib/html_sanitize_ex/scrubber/html5.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:scrub_attribute/2"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:sanitize/1"
},
{
"name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"vendor": "rrrene",
"versions": [
{
"changes": [
{
"at": "9f7e38be51edc38f132dfe994f37af5cf5e0e76f",
"status": "unaffected"
},
{
"at": "29454dc99513fd9b5b6429ab7b6695ad09889227",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "8976d64ea0b77d26093a94a43ec48a3978e8d028",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOnly \u003ccode\u003eHtmlSanitizeEx.html5/1\u003c/code\u003e, and custom scrubbers declared with \u003ccode\u003euse HtmlSanitizeEx, extend: :html5\u003c/code\u003e, allow the \u003ccode\u003emeta\u003c/code\u003e element, and the sanitized output must be rendered to other users.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Only `HtmlSanitizeEx.html5/1`, and custom scrubbers declared with `use HtmlSanitizeEx, extend: :html5`, allow the `meta` element, and the sanitized output must be rendered to other users."
}
],
"value": "Only HtmlSanitizeEx.html5/1, and custom scrubbers declared with use HtmlSanitizeEx, extend: :html5, allow the meta element, and the sanitized output must be rendered to other users."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.5",
"versionStartIncluding": "0.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.5.3",
"versionStartIncluding": "1.5.0-rc.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ren\u00e9 F\u00f6hring"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eURL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker\u0027s choosing via a \u003ccode\u003e\u0026lt;meta http-equiv=\"refresh\"\u0026gt;\u003c/code\u003e element in sanitized HTML. \u003ccode\u003eHtmlSanitizeEx.html5/1\u003c/code\u003e keeps attacker-supplied \u003ccode\u003e\u0026lt;meta\u0026gt;\u003c/code\u003e elements in its output. A \u003ccode\u003emeta\u003c/code\u003e element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as \u003ccode\u003eContent-Security-Policy\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis is not cross-site scripting. Browsers do not navigate a meta refresh to a \u003ccode\u003ejavascript:\u003c/code\u003e URL, so the uppercase \u003ccode\u003eJAVASCRIPT:\u003c/code\u003e filter bypass yields no script execution and none was demonstrated.\u003c/p\u003e\n\u003cp\u003eThis issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker\u0027s choosing via a `\u003cmeta http-equiv=\"refresh\"\u003e` element in sanitized HTML. `HtmlSanitizeEx.html5/1` keeps attacker-supplied `\u003cmeta\u003e` elements in its output. A `meta` element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as `Content-Security-Policy`.\n\nThis is not cross-site scripting. Browsers do not navigate a meta refresh to a `javascript:` URL, so the uppercase `JAVASCRIPT:` filter bypass yields no script execution and none was demonstrated.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3."
}
],
"value": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker\u0027s choosing via a \u003cmeta http-equiv=\"refresh\"\u003e element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied \u003cmeta\u003e elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy.\n\nThis is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3."
}
],
"impacts": [
{
"capecId": "CAPEC-154",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-154 Resource Location Spoofing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T11:50:39.885Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-2c6f-3j54-xpcr"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-66829.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-66829"
},
{
"tags": [
"patch"
],
"url": "https://github.com/rrrene/html_sanitize_ex/commit/9f7e38be51edc38f132dfe994f37af5cf5e0e76f"
},
{
"tags": [
"patch"
],
"url": "https://github.com/rrrene/html_sanitize_ex/commit/29454dc99513fd9b5b6429ab7b6695ad09889227"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSanitize with \u003ccode\u003ebasic_html/1\u003c/code\u003e, \u003ccode\u003emarkdown_html/1\u003c/code\u003e or \u003ccode\u003estrip_tags/1\u003c/code\u003e, none of which allow \u003ccode\u003emeta\u003c/code\u003e, or define a custom scrubber that omits it.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Sanitize with `basic_html/1`, `markdown_html/1` or `strip_tags/1`, none of which allow `meta`, or define a custom scrubber that omits it."
}
],
"value": "Sanitize with basic_html/1, markdown_html/1 or strip_tags/1, none of which allow meta, or define a custom scrubber that omits it."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-66829",
"datePublished": "2026-08-06T14:49:23.468Z",
"dateReserved": "2026-08-06T08:15:02.719Z",
"dateUpdated": "2026-08-19T11:50:39.885Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.