← Back to CVE Explorer

CVE-2026-66829

Full vulnerability record from the local CVENow database.

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a <meta http-equiv="refresh"> element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied <meta> elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy. This is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.

Severity
LOW
CVSS score
2.3 (v4.0)
Vulnerability status
Modified
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-08-06 16:16:49.450000
Last modified
2026-10-24 16:10:00.153000
View original CVE JSON 
{
  "id": "CVE-2026-66829",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-08-06T16:16:49.450",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a <meta http-equiv=\"refresh\"> element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied <meta> elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy.\n\nThis is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de redirección de URL a sitio no confiable (’redirección abierta’) en el depurador HTML5 de rrrene html_sanitize_ex permite a un atacante remoto forzar a los visitantes de una página a navegar a un sitio elegido por el atacante a través de un elemento menor quemeta http-equiv=“refresh”mayor que en HTML saneado. HtmlSanitizeEx.html5/1 mantiene los elementos [meta] proporcionados por el atacante en su salida. Un elemento meta actúa sobre todo el documento en lugar de sobre el fragmento en el que fue incrustado, por lo que también puede declarar directivas a nivel de documento como Content-Security-Policy.\n\nEsto no es cross-site scripting. Los navegadores no navegan una meta refresh a una URL javascript_disabled: , por lo que el bypass del filtro javascript_disabled: en mayúsculas no produce ejecución de script y no se demostró ninguna.\n\nEste problema afecta a html_sanitize_ex: desde 0.3.1 antes de 1.5.3."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "rrrene",
          "product": "html_sanitize_ex",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "html_sanitize_ex",
          "cpes": [
            "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Elixir.HtmlSanitizeEx.Scrubber.HTML5",
            "Elixir.HtmlSanitizeEx"
          ],
          "programFiles": [
            "lib/html_sanitize_ex/scrubber/html5.ex",
            "lib/html_sanitize_ex.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.HtmlSanitizeEx.Scrubber.HTML5':scrub_attribute/2"
            },
            {
              "name": "'Elixir.HtmlSanitizeEx.Scrubber.HTML5':sanitize/1"
            },
            {
              "name": "'Elixir.HtmlSanitizeEx':html5/1"
            }
          ],
          "repo": "https://github.com/rrrene/html_sanitize_ex",
          "packageURL": "pkg:hex/html_sanitize_ex",
          "versions": [
            {
              "version": "0.3.1",
              "lessThan": "1.4.5",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.5.0-rc.0",
              "lessThan": "1.5.3",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "rrrene",
          "product": "html_sanitize_ex",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "rrrene/html_sanitize_ex",
          "cpes": [
            "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Elixir.HtmlSanitizeEx.Scrubber.HTML5",
            "Elixir.HtmlSanitizeEx"
          ],
          "programFiles": [
            "lib/html_sanitize_ex/scrubber/html5.ex",
            "lib/html_sanitize_ex.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.HtmlSanitizeEx.Scrubber.HTML5':scrub_attribute/2"
            },
            {
              "name": "'Elixir.HtmlSanitizeEx.Scrubber.HTML5':sanitize/1"
            },
            {
              "name": "'Elixir.HtmlSanitizeEx':html5/1"
            }
          ],
          "repo": "https://github.com/rrrene/html_sanitize_ex",
          "packageURL": "pkg:github/rrrene/html_sanitize_ex",
          "versions": [
            {
              "version": "8976d64ea0b77d26093a94a43ec48a3978e8d028",
              "lessThan": "*",
              "versionType": "git",
              "status": "affected",
              "changes": [
                {
                  "at": "9f7e38be51edc38f132dfe994f37af5cf5e0e76f",
                  "status": "unaffected"
                },
                {
                  "at": "29454dc99513fd9b5b6429ab7b6695ad09889227",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 2.3,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-06T15:42:40.366099Z",
          "id": "CVE-2026-66829",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:rrrene:htmlsanitizeex:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "0.3.1",
              "versionEndExcluding": "1.5.3",
              "matchCriteriaId": "DE85053C-AE84-4570-A90C-4D4CCD7A4BA3"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-66829.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/rrrene/html_sanitize_ex/commit/29454dc99513fd9b5b6429ab7b6695ad09889227",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/rrrene/html_sanitize_ex/commit/9f7e38be51edc38f132dfe994f37af5cf5e0e76f",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-2c6f-3j54-xpcr",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Broken Link"
      ]
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-66829",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ]
    }
  ]
}