EUVD-2026-54081
GHSA-r8xc-fmjg-37c5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the hard prerequisite of a page-resident form with a guessable id; S:C and C:H capture credential exfiltration to an attacker-controlled subsequent endpoint.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
2DescriptionCVE.org
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction attributes on an <input> element in sanitized HTML. HTML's form attribute associates an input with any form on the page by its id even when the input sits outside that form, and formaction on a submit control overrides the owning form's action. Neither attribute receives a scheme check, so an absolute cross-origin URL survives sanitizing.
No script executes. The scrubber allows neither form nor button, so the attacker cannot introduce a form of their own and the rendering page must already contain a form carrying an id.
This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.
AnalysisAI
html_sanitize_ex's HTML5 scrubber (versions 0.3.1 through 1.5.2) permits the form and formaction attributes to survive sanitization on <input> elements, enabling unauthenticated remote attackers to silently hijack existing page forms and redirect victim submissions - including credentials - to an attacker-controlled endpoint. The attack exploits HTML's native form association model (no script required), but succeeds only when the rendering page already contains a form with a known or guessable id attribute. No active exploitation or CISA KEV listing has been identified at time of analysis, and no EPSS score was included in source data.
Technical ContextAI
html_sanitize_ex is an Elixir HTML sanitization library (CPE: cpe:2.3:a:rrrene:html_sanitize_ex) offering multiple scrubber presets; the HTML5 scrubber is its broadest allowlist. The root cause (CWE-601, URL Redirection to Untrusted Site) is an incomplete attribute denylist: prior to 1.5.3, the scrubber explicitly permitted form, formaction, formenctype, formmethod, formnovalidate, and formtarget attributes on <input> elements without performing any scheme or origin validation. HTML's form association mechanism allows an <input form='target-id'> placed anywhere in the DOM to participate in a separate <form id='target-id'> regardless of DOM position; formaction on a submit control then overrides that form's action URL with an arbitrary absolute cross-origin URL. The scrubber correctly blocked <form> and <button> element insertion, preventing an attacker from introducing a self-contained phishing form, but the attribute-level bypass on <input> remained exploitable as long as the rendering page already contained a victim form. The fix at commit a1e804ed removes all six form-override attributes from the allowlist across multiple element definitions in lib/html_sanitize_ex/scrubber/html5.ex.
RemediationAI
Upgrade html_sanitize_ex to version 1.5.3 or later, which removes form, formaction, formenctype, formmethod, formnovalidate, and formtarget from the HTML5 scrubber's allowlist, as documented in patch commit a1e804ed997e780ea71d14393cf2f701330553a6 and the vendor advisory at https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-w3f9-jjhw-wwvq. For applications unable to upgrade immediately, audit all pages that render html_sanitize_ex-processed user content and eliminate any <form> elements with predictable id attributes on those specific pages - this removes the page-resident anchor required for exploitation and carries no functional side effect for most applications. A second interim option is to post-process scrubber output to strip form and formaction attributes before rendering; this adds a maintenance dependency on a custom filter but is straightforward to implement. Retaining these attributes in sanitized HTML serves no legitimate use case, so upgrading carries no functional regression.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today