CVE-2026-117645

Name of the Vulnerable Software and Affected Versions phoenix html versions 1.0.0 through 3.3.4 phoenix html versions 4.0.0 through 4.3.9

Description Cross-site Scripting (XSS) occurs when an attacker controls attribute names, allowing the injection of attributes and scripts into rendered HTML via the Phoenix.HTML.attributes escape/1 function. The key escape/1 function fails to properly neutralize whitespace in binary keys, enabling the creation of new attributes such as event handlers. Additionally, atom keys are only dasherized, allowing characters like quotes and angle brackets to pass through. This issue affects applications that build attribute keys from untrusted input and render them using HEEx <tag {@attrs}>, content tag/3, or direct calls. Nested data, aria, and phx keys are also susceptible. This can lead to the execution of arbitrary scripts in the browsers of users viewing the affected pages.

Recommendations Update phoenix html to version 3.3.5 or later for versions in the 1.x to 3.x range. Update phoenix html to version 4.4.0 or later for versions in the 4.x range. Do not derive attribute names from untrusted input. When dynamic attribute keys are required, validate each key against an allow list or a pattern such as ^[a-zA-Z][a-zA-Z0-9:. -]*$ before passing it to attributes escape/1 or a HEEx {@attrs} expression. Avoid creating atoms from request data.