CVE-2026-66829

Modified Modified - Updated After Analysis

Open Redirect in html_sanitize_ex via HTML5 Scrubber

Publication date: 2026-08-06

Last updated on: 2026-08-19

Assigner: EEF

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy. This is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-19

Generated

2026-08-26

AI Q&A

2026-08-06

EPSS Evaluated

2026-08-25

NVD

CVE-2026-66829

EUVD

EUVD-2026-54082

Affected Vendors & Products

Vendor	Product	Version / Range
rrrene	htmlsanitizeex	From 0.3.1 (inc) to 1.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

This is an Open Redirect vulnerability in the html_sanitize_ex library's HTML5 scrubber. It allows a remote attacker to force users to visit a malicious website by injecting a <meta http-equiv="refresh"> tag into sanitized HTML. The scrubber fails to remove these tags, enabling document-wide redirects. It does not allow JavaScript execution since browsers block meta refreshes to javascript: URLs.

Detection Guidance

To detect this vulnerability, inspect HTML sanitization outputs for unsanitized <meta http-equiv="refresh"> tags in versions 0.3.1 to 1.5.2 of html_sanitize_ex. Check sanitized HTML content for meta tags with refresh attributes or malicious content patterns.

Impact Analysis

An attacker could trick users into visiting a phishing site or malware download page by exploiting this flaw. Users might unknowingly enter credentials or download malicious files. The impact is limited to redirection, not code execution, but could still lead to credential theft or malware infections.

Compliance Impact

This vulnerability primarily enables open redirect attacks, which could lead to phishing or unauthorized data exposure. While not directly violating GDPR or HIPAA, such attacks may facilitate breaches of confidentiality or unauthorized access, potentially impacting compliance with data protection requirements.

Mitigation Strategies

Upgrade html_sanitize_ex to version 1.5.3 or later. Alternatively, switch to alternative sanitization functions like basic_html/1, markdown_html/1, or strip_tags/1. Implement custom scrubbers that explicitly block meta elements.

Hi! I’m here to help you understand CVE-2026-66829. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70