Doggo
Monthly
Reflected XSS in doggo's Phoenix date field component (versions 0.1.0 through 0.14.7) allows network-accessible, unauthenticated attackers to inject HTML into the rendered page when a form validation failure re-renders a user-supplied date value. The root cause is `Doggo.normalize_value/2` wrapping the raw user input in Phoenix.HTML's `{:safe, ...}` marker - bypassing the framework's built-in escaping - before emitting it verbatim into the `value` attribute of the generated `<input>` element. Payloads are constrained to ten bytes by the original truncation logic, which prevents full inline script injection but still permits attribute-breaking strings (e.g., `" onload=x`) sufficient to attach short event handlers. No public exploit has been identified and the vulnerability is not listed in CISA KEV; a vendor patch is available in doggo 0.14.8.
Reflected XSS in doggo's Phoenix date field component (versions 0.1.0 through 0.14.7) allows network-accessible, unauthenticated attackers to inject HTML into the rendered page when a form validation failure re-renders a user-supplied date value. The root cause is `Doggo.normalize_value/2` wrapping the raw user input in Phoenix.HTML's `{:safe, ...}` marker - bypassing the framework's built-in escaping - before emitting it verbatim into the `value` attribute of the generated `<input>` element. Payloads are constrained to ten bytes by the original truncation logic, which prevents full inline script injection but still permits attribute-breaking strings (e.g., `" onload=x`) sufficient to attach short event handlers. No public exploit has been identified and the vulnerability is not listed in CISA KEV; a vendor patch is available in doggo 0.14.8.