phoenix_html CVE-2026-117645

Exploitation requires the affected application to construct HTML attribute *keys* (names) from untrusted input and then render them through HEEx <tag {@attrs}>, content_tag/3, or a direct Phoenix.HTML.attributes_escape/1 call (before 3.0.0, the equivalent code in Phoenix.HTML.Tag); nested data, aria, and phx keys follow the same vulnerable paths. It does NOT affect the default/typical pattern of passing untrusted attribute *values*, which remain correctly escaped. Limiting factors: a victim must load and interact with the rendered page (UI:P/UI:R), and the impact is bounded to in-browser script execution (low confidentiality/integrity, no availability). The determinative precondition is the non-default developer pattern of deriving attribute names from user data - applications that never do this are not exploitable even on affected versions.

This is a genuine but conditional XSS (CWE-79) in a core Elixir/Phoenix library, and the signals point to moderate rather than urgent real-world risk. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, VC:L/VI:L) describes a network-reachable, low-complexity, unauthenticated flaw needing passive user interaction, scored 5.3 - consistent with a reflected/stored XSS of limited confidentiality and integrity impact. The vuln.today decision label is 'this_month' (not act_now/emergency), there is no CISA KEV entry and no EPSS score in the input, and no public exploit or PoC reference is provided (the listed GitHub links are the vendor patch and source commits, not exploit code). The dominant risk limiter is architectural: per the description and source evidence, the application is only affected if it builds HTML attribute *names* (keys) from untrusted input and renders them via HEEx <tag {@attrs}>, content_tag/3, or a direct call to Phoenix.HTML.attributes_escape/1 - an uncommon coding pattern, since attribute values (the usual injection surface) are correctly escaped. So despite the PR:N network vector, exploitability depends on a specific, non-default application behavior rather than on reaching a default install. Net: treat as a standard-priority patch for Phoenix/Elixir shops, elevated only for apps known to derive attribute keys from user data.

An Elixir/Phoenix application renders a dynamic attribute map whose keys originate from user-controlled data (for example user-supplied data-*/aria-* names) through HEEx {@attrs} or content_tag/3. An attacker submits a key such as x onmouseover=alert(document.cookie) (binary key) or an atom key containing quotes and >, which attributes_escape/1 does not neutralize in the key position, so the rendered markup gains an injected event handler or element. A victim who loads and interacts with the page (UI:P) triggers script execution in their browser session; no public exploit was identified at time of analysis.