CVE-2026-66370

Analyzed Analyzed - Analysis Complete

HTML5 Scrubber Open Redirect in html_sanitize_ex

Publication date: 2026-08-06

Last updated on: 2026-08-11

Assigner: EEF

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction attributes on an <input> element in sanitized HTML. HTML's form attribute associates an input with any form on the page by its id even when the input sits outside that form, and formaction on a submit control overrides the owning form's action. Neither attribute receives a scheme check, so an absolute cross-origin URL survives sanitizing. No script executes. The scrubber allows neither form nor button, so the attacker cannot introduce a form of their own and the rendering page must already contain a form carrying an id. This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-11

Generated

2026-08-18

AI Q&A

2026-08-06

EPSS Evaluated

2026-08-17

NVD

CVE-2026-66370

EUVD

EUVD-2026-54081

Affected Vendors & Products

Vendor	Product	Version / Range
rrrene	htmlsanitizeex	From 0.3.1 (inc) to 1.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

This vulnerability is an Open Redirect flaw in the html_sanitize_ex library's HTML5 scrubber. It allows an attacker to retarget an existing form on a page using form and formaction attributes in sanitized HTML. These attributes can override the form's action URL without proper scheme validation, enabling cross-origin redirects. The attacker can capture user-submitted data, including credentials, but cannot execute scripts or introduce new forms.

Detection Guidance

To detect this vulnerability, check if your system uses html_sanitize_ex versions between 0.3.1 and 1.5.2. Inspect HTML sanitization output for allowed attributes like form, formaction, formenctype, formmethod, formnovalidate, and formtarget. Use commands like grep to search for these attributes in sanitized HTML or library configurations.

Impact Analysis

If you use html_sanitize_ex versions 0.3.1 to 1.5.2, an attacker could trick users into submitting form data to a malicious site. This could lead to credential theft, data leaks, or phishing attacks. The impact depends on whether your application uses sanitized HTML in user-generated content or trusted contexts.

Compliance Impact

This vulnerability could lead to unauthorized data collection, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. If exploited, it may result in data breaches, triggering compliance obligations like breach notifications and potential fines under these regulations.

Mitigation Strategies

Upgrade html_sanitize_ex to version 1.5.3 or later. Alternatively, switch to alternative sanitization functions like basic_html/1, markdown_html/1, or strip_tags/1. Remove or avoid predictable id values from forms and exclude problematic attributes from custom scrubbers.

Hi! I’m here to help you understand CVE-2026-66370. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70