CVE-2026-66370: htmlsanitizeex from 0.3.1 (inclusive), before 1.5.3 (exclusive); +1 more affected products

Affected technology

htmlsanitizeex · from 0.3.1 (inclusive), before 1.5.3 (exclusive)
rrrene

html_sanitize_ex · 0.3.1 to before 1.4.5, 1.5.0-rc.0 to before 1.5.3
rrrene

html_sanitize_ex · 8976d64ea0b77d26093a94a43ec48a3978e8d028 to before *; status changes: a1e804ed997e780ea71d14393cf2f701330553a6 — unaffected, 21394e758cb0ffe12fb9953c30fdedc6016c8f9e — unaffected
rrrene

Component: Elixir.HtmlSanitizeEx.Scrubber.HTML5, Elixir.HtmlSanitizeEx
Function: 'Elixir.HtmlSanitizeEx.Scrubber.HTML5':scrub_attribute/2, 'Elixir.HtmlSanitizeEx.Scrubber.HTML5':sanitize/1, 'Elixir.HtmlSanitizeEx':html5/1
File: lib/html_sanitize_ex/scrubber/html5.ex, lib/html_sanitize_ex.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

An unauthenticated remote attacker can retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction attributes on an element in sanitized HTML. Source advisory’s CVSS 4.0 assessment (base score 4.8/10) rates confidentiality, integrity and availability impact as none.