CVE-2026-66829
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
An Open Redirect vulnerability in the html_sanitize_ex library (HTML5 scrubber component) allows a remote attacker to force visitors to navigate to an attacker-chosen site via a <meta http-equiv="refresh"> element in sanitized HTML. The library keeps attacker-supplied <meta> elements in its output, which can also declare document-wide directives such as Content-Security-Policy. Affected versions are from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.
Risk Assessment
An attacker can exploit this to redirect users to malicious sites, potentially leading to phishing, data theft, or malware installation. Additionally, the ability to inject CSP directives may weaken the page's security.
Recommendation
Update the html_sanitize_ex library to version 1.4.5 or later (if using 1.x) or to version 1.5.3 or later (if using 1.5.0-rc). Ensure all deployments use the patched version.
Other vulnerabilities in html_sanitize_ex
See all- CVE-2026-68750High
An Inefficient Algorithmic Complexity vulnerability in the traversal engine in html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The List.flatten operation in Traverser.traverse/2 causes quadratic complexity in sibling count, leading to resource exhaustion.
- CVE-2026-68749High
An Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The regex in CSS.scrub/1 has quadratic complexity for long strings, leading to CPU exhaustion.
- CVE-2026-68747Medium
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed. Element boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes. Affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.4.
- CVE-2026-66843Medium
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive. This is not unconditional cross-site scripting, but poses a risk. Affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.
- CVE-2026-66370Medium
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction attributes on an <input> element in sanitized HTML. HTML's form attribute associates an input with any form on the page by its id even when the input sits outside that form, and formaction on a submit control overrides the owning form's action. Neither attribute receives a scheme check, so an absolute cross-origin URL survives sanitizing. No script executes. The scrubber allows neither form nor button, so the attacker cannot introduce a form of their own and the rendering page must already contain a form carrying an id. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.
Original NVD description (English source)
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a <meta http-equiv="refresh"> element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied <meta> elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy. This is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.