CVE-2026-66353
Received Received - Intake

Reflected Cross-Site Scripting in Doggo

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: EEF

Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woylie doggo allows Reflected XSS. Doggo.normalize_value/2 in lib/doggo.ex returned date field values wrapped in {:safe, ...}, the Phoenix.HTML marker meaning "already escaped, emit verbatim", without escaping them, so the value reached the value attribute of the <input> rendered by the field component unchanged. Any application rendering <.field type="date"> over user-controlled params is affected through the ordinary Phoenix form round-trip, where a failed validation re-renders the submitted value. The pattern kept exactly the first ten bytes and discarded shorter values, capping a payload at ten bytes: enough to terminate the attribute and open an element or attach a short event handler, not enough to place attacker-chosen script inline. Only type="date" is affected. This issue affects doggo: from 0.1.0 before 0.14.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-28
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-66353

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
woylie doggo to 0.14.8 (exc)
woylie doggo From 0.1.0 (inc) to 0.14.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Reflected Cross-site Scripting (XSS) vulnerability in the woylie doggo application. It occurs when date field values are not properly escaped before being rendered in HTML input fields. The Doggo.normalize_value/2 function in lib/doggo.ex returns date values wrapped in {:safe, ...} without escaping them, allowing user-controlled input to bypass security measures. Only date type input fields are affected.

Detection Guidance

This vulnerability is specific to the doggo library (versions 0.1.0 to 0.14.7) and involves reflected XSS in date fields. Detection requires checking if your application uses the affected doggo versions and if date fields are rendered with user-controlled input.

Impact Analysis

An attacker could craft malicious input to execute arbitrary JavaScript in a victim's browser when they visit a page with a date input field. This could lead to session hijacking, defacement, or theft of sensitive data. The attack requires user interaction and is limited to short payloads due to input truncation.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade doggo to version 0.14.8 or later to resolve the issue. If upgrading is not possible, review all date field components to ensure proper escaping of user input before rendering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66353. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart