CVE-2026-66829: htmlsanitizeex from 0.3.1 (inclusive), before 1.5.3 (exclusive); +1 more affected products

Affected technology

htmlsanitizeex · from 0.3.1 (inclusive), before 1.5.3 (exclusive)
rrrene

html_sanitize_ex · 0.3.1 to before 1.4.5, 1.5.0-rc.0 to before 1.5.3
rrrene

html_sanitize_ex · 8976d64ea0b77d26093a94a43ec48a3978e8d028 to before *; status changes: 9f7e38be51edc38f132dfe994f37af5cf5e0e76f — unaffected, 29454dc99513fd9b5b6429ab7b6695ad09889227 — unaffected
rrrene

Component: Elixir.HtmlSanitizeEx.Scrubber.HTML5, Elixir.HtmlSanitizeEx
Function: 'Elixir.HtmlSanitizeEx.Scrubber.HTML5':scrub_attribute/2, 'Elixir.HtmlSanitizeEx.Scrubber.HTML5':sanitize/1, 'Elixir.HtmlSanitizeEx':html5/1
File: lib/html_sanitize_ex/scrubber/html5.ex, lib/html_sanitize_ex.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

A remote attacker can force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. Source advisory’s CVSS 4.0 assessment (base score 2.3/10) rates confidentiality, integrity and availability impact as none.