CVE-2026-66829

Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.2

Description An Open Redirect issue exists in the HTML5 scrubber of the software. A remote attacker can force visitors to navigate to an untrusted site by inserting a <meta http-equiv="refresh"> element into sanitized HTML. This occurs because HtmlSanitizeEx.html5/1 retains attacker-supplied <meta> elements in its output. Since a meta element affects the entire document rather than just the embedded fragment, it can also be used to declare document-wide directives, such as Content-Security-Policy (a security layer that helps detect and mitigate certain types of attacks, including cross-site scripting and data injection attacks).

Recommendations Update html sanitize ex to version 1.5.3 or later. As a temporary workaround, sanitize content using basic html/1, markdown html/1, or strip tags/1, as these do not allow meta elements. Alternatively, define a custom scrubber that omits the <meta> element.