CVE-2026-66370

Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.2

Description An Open Redirect issue exists in the HTML5 scrubber where an unauthenticated remote attacker can retarget an existing form on a rendering page to capture submitted data, including credentials. This is achieved using the form and formaction attributes on an <input> element within sanitized HTML. The form attribute links an input to a form via its id, and the formaction attribute overrides the form's destination. Because these attributes lack scheme checks, absolute cross-origin URLs are not removed during sanitization. This attack requires the rendering page to already contain a form with an id, as the scrubber prevents the introduction of new form or button elements.

Recommendations Update html sanitize ex to version 1.5.3 or later. As a temporary workaround, sanitize content using basic html/1, markdown html/1, or strip tags/1, or define a custom scrubber that omits the <input> element. Remove the id attribute from forms on the page or use unpredictable values for these IDs to prevent attackers from binding to them.