CVE-2026-66353

Name of the Vulnerable Software and Affected Versions woylie doggo versions 0.1.0 through 0.14.7

Description Reflected Cross-site Scripting (XSS) occurs when the Doggo.normalize value/2 function in lib/doggo.ex returns date field values wrapped in a {:safe, ...} marker. This marker instructs Phoenix.HTML to emit the content verbatim without escaping, allowing the value to reach the value attribute of the rendered <input> element unchanged. This affects applications rendering <.field type="date"> using user-controlled parameters during a Phoenix form round-trip when validation fails and the submitted value is re-rendered. The payload is limited to ten bytes, which is sufficient to terminate the attribute and open an element or attach a short event handler, but insufficient for inline scripts.

Recommendations Update to version 0.14.8 or later. Use type="text" instead of type="date" for fields receiving user-submitted parameters. Pass an explicit value already validated as an ISO 8601 date to the component instead of allowing it to read directly from the form field.