{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66829", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-08-06T08:15:02.719Z", "datePublished": "2026-08-06T14:49:23.468Z", "dateUpdated": "2026-08-06T14:49:23.468Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["Elixir.HtmlSanitizeEx.Scrubber.HTML5", "Elixir.HtmlSanitizeEx"], "packageName": "html_sanitize_ex", "packageURL": "pkg:hex/html_sanitize_ex", "product": "html_sanitize_ex", "programFiles": ["lib/html_sanitize_ex/scrubber/html5.ex", "lib/html_sanitize_ex.ex"], "programRoutines": [{"name": "'Elixir.HtmlSanitizeEx.Scrubber.HTML5':scrub_attribute/2"}, {"name": "'Elixir.HtmlSanitizeEx.Scrubber.HTML5':sanitize/1"}, {"name": "'Elixir.HtmlSanitizeEx':html5/1"}], "repo": "https://github.com/rrrene/html_sanitize_ex", "vendor": "rrrene", "versions": [{"lessThan": "1.5.3", "status": "affected", "version": "0.3.1", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["Elixir.HtmlSanitizeEx.Scrubber.HTML5", "Elixir.HtmlSanitizeEx"], "packageName": "rrrene/html_sanitize_ex", "packageURL": "pkg:github/rrrene/html_sanitize_ex", "product": "html_sanitize_ex", "programFiles": ["lib/html_sanitize_ex/scrubber/html5.ex", "lib/html_sanitize_ex.ex"], "programRoutines": [{"name": "'Elixir.HtmlSanitizeEx.Scrubber.HTML5':scrub_attribute/2"}, {"name": "'Elixir.HtmlSanitizeEx.Scrubber.HTML5':sanitize/1"}, {"name": "'Elixir.HtmlSanitizeEx':html5/1"}], "repo": "https://github.com/rrrene/html_sanitize_ex", "vendor": "rrrene", "versions": [{"lessThan": "9f7e38be51edc38f132dfe994f37af5cf5e0e76f", "status": "affected", "version": "8976d64ea0b77d26093a94a43ec48a3978e8d028", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Only <code>HtmlSanitizeEx.html5/1</code>, and custom scrubbers declared with <code>use HtmlSanitizeEx, extend: :html5</code>, allow the <code>meta</code> element, and the sanitized output must be rendered to other users.</p>"}, {"base64": false, "type": "text/markdown", "value": "Only `HtmlSanitizeEx.html5/1`, and custom scrubbers declared with `use HtmlSanitizeEx, extend: :html5`, allow the `meta` element, and the sanitized output must be rendered to other users."}], "value": "Only HtmlSanitizeEx.html5/1, and custom scrubbers declared with use HtmlSanitizeEx, extend: :html5, allow the meta element, and the sanitized output must be rendered to other users."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.5.3", "versionStartIncluding": "0.3.1", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}, {"lang": "en", "type": "remediation developer", "value": "Ren\u00e9 F\u00f6hring"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a <code>&lt;meta http-equiv=\"refresh\"&gt;</code> element in sanitized HTML. <code>HtmlSanitizeEx.html5/1</code> keeps attacker-supplied <code>&lt;meta&gt;</code> elements in its output. A <code>meta</code> element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as <code>Content-Security-Policy</code>.</p>\n<p>This is not cross-site scripting. Browsers do not navigate a meta refresh to a <code>javascript:</code> URL, so the uppercase <code>JAVASCRIPT:</code> filter bypass yields no script execution and none was demonstrated.</p>\n<p>This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.</p>"}, {"base64": false, "type": "text/markdown", "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a `<meta http-equiv=\"refresh\">` element in sanitized HTML. `HtmlSanitizeEx.html5/1` keeps attacker-supplied `<meta>` elements in its output. A `meta` element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as `Content-Security-Policy`.\n\nThis is not cross-site scripting. Browsers do not navigate a meta refresh to a `javascript:` URL, so the uppercase `JAVASCRIPT:` filter bypass yields no script execution and none was demonstrated.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.3."}], "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a <meta http-equiv=\"refresh\"> element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied <meta> elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy.\n\nThis is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.5.3."}], "impacts": [{"capecId": "CAPEC-154", "descriptions": [{"lang": "en", "value": "CAPEC-154 Resource Location Spoofing"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 2.3, "baseSeverity": "LOW", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-08-06T14:49:23.468Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-2c6f-3j54-xpcr"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-66829.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-66829"}, {"tags": ["patch"], "url": "https://github.com/rrrene/html_sanitize_ex/commit/9f7e38be51edc38f132dfe994f37af5cf5e0e76f"}], "source": {"discovery": "EXTERNAL"}, "title": "html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Sanitize with <code>basic_html/1</code>, <code>markdown_html/1</code> or <code>strip_tags/1</code>, none of which allow <code>meta</code>, or define a custom scrubber that omits it.</p>"}, {"base64": false, "type": "text/markdown", "value": "Sanitize with `basic_html/1`, `markdown_html/1` or `strip_tags/1`, none of which allow `meta`, or define a custom scrubber that omits it."}], "value": "Sanitize with basic_html/1, markdown_html/1 or strip_tags/1, none of which allow meta, or define a custom scrubber that omits it."}]}}}

{}

{}

{}

{}