Html Sanitize Ex
Monthly
Quadratic CPU and memory exhaustion in html_sanitize_ex affects all applications that accept user-supplied HTML for sanitization, regardless of scrubber configuration. The traversal engine's list clause performs a redundant List.flatten over the entire remaining sibling tail at every recursion step, making sanitization cost O(n²) in sibling count rather than O(n). A 160 KB input of 20,000 sibling elements monopolizes a BEAM scheduler for approximately 1.7 seconds per request; no public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the attack requires no authentication and no special server configuration.
CPU exhaustion via quadratic regex backtracking in rrrene/html_sanitize_ex, an Elixir HTML sanitization library, allows unauthenticated remote attackers to saturate the BEAM scheduler pool and render applications unresponsive. The CSS scrubber's declaration regex applies an unbounded greedy quantifier on the property-name token; a crafted 80 KB style body containing no valid CSS colon costs approximately 2.4 seconds of scheduler time per request, meaning a handful of concurrent requests fully deny service. Affected versions span 0.3.1 through 1.5.2 inclusive; impact is strictly availability — no confidentiality or integrity loss occurs. No public exploit or CISA KEV listing is identified at time of analysis.
CSS at-rule injection in html_sanitize_ex (Elixir, versions 0.3.1-1.5.3) allows unauthenticated remote users to embed `@import` directives that survive sanitization and are rendered in other users' browsers. The `HtmlSanitizeEx.Scrubber.CSS.scrub/1` function applied its allowlist exclusively to `property: value` declaration patterns; `@import` at-rules, which are syntactically distinct, were never inspected and passed through verbatim. Three distinct bypass paths existed: bare `@import url(...)`, no-whitespace `@import"url"`, and CSS hex-escaped `@\69 mport`. No public exploit code is identified at time of analysis; a vendor patch is available as version 1.5.4.
Open redirect in html_sanitize_ex (Elixir, versions 0.3.1 through 1.5.2) allows remote attackers to force page visitors to navigate to attacker-controlled URLs by injecting `<meta http-equiv="refresh">` elements that the HTML5 scrubber (HtmlSanitizeEx.Scrubber.HTML5) passes through intact into sanitized output. Because a meta refresh acts at document scope rather than fragment scope, it overrides the host page's navigation regardless of where the sanitized fragment is embedded. The CVE description explicitly rules out JavaScript execution - this is a pure redirect primitive - and no public exploit has been identified at time of analysis.
html_sanitize_ex's HTML5 scrubber (versions 0.3.1 through 1.5.2) permits the `form` and `formaction` attributes to survive sanitization on `<input>` elements, enabling unauthenticated remote attackers to silently hijack existing page forms and redirect victim submissions - including credentials - to an attacker-controlled endpoint. The attack exploits HTML's native form association model (no script required), but succeeds only when the rendering page already contains a form with a known or guessable `id` attribute. No active exploitation or CISA KEV listing has been identified at time of analysis, and no EPSS score was included in source data.
html_sanitize_ex's HTML5 scrubber (versions 0.3.1 through before 1.5.3) passes attacker-controlled URIs through the `data` attribute of `<object>` elements after a trivially bypassed case-sensitive prefix check, allowing remote attackers to embed arbitrary external or same-origin documents into sanitized pages viewed by victims. The `<object>` tag was never registered through the library's `allow_tag_with_uri_attributes/3` URI-validation mechanism, and its sole guard - a literal lowercase `javascript:` prefix match - is defeated by mixed-case variants, `data:` URIs, protocol-relative URLs, and same-origin relative paths. No public exploit has been identified at time of analysis, and no active exploitation (CISA KEV) has been confirmed; the CVSS 4.0 score of 2.3 correctly reflects constrained real-world impact due to browser-enforced origin isolation on embedded `<object>` content.
Quadratic CPU and memory exhaustion in html_sanitize_ex affects all applications that accept user-supplied HTML for sanitization, regardless of scrubber configuration. The traversal engine's list clause performs a redundant List.flatten over the entire remaining sibling tail at every recursion step, making sanitization cost O(n²) in sibling count rather than O(n). A 160 KB input of 20,000 sibling elements monopolizes a BEAM scheduler for approximately 1.7 seconds per request; no public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the attack requires no authentication and no special server configuration.
CPU exhaustion via quadratic regex backtracking in rrrene/html_sanitize_ex, an Elixir HTML sanitization library, allows unauthenticated remote attackers to saturate the BEAM scheduler pool and render applications unresponsive. The CSS scrubber's declaration regex applies an unbounded greedy quantifier on the property-name token; a crafted 80 KB style body containing no valid CSS colon costs approximately 2.4 seconds of scheduler time per request, meaning a handful of concurrent requests fully deny service. Affected versions span 0.3.1 through 1.5.2 inclusive; impact is strictly availability — no confidentiality or integrity loss occurs. No public exploit or CISA KEV listing is identified at time of analysis.
CSS at-rule injection in html_sanitize_ex (Elixir, versions 0.3.1-1.5.3) allows unauthenticated remote users to embed `@import` directives that survive sanitization and are rendered in other users' browsers. The `HtmlSanitizeEx.Scrubber.CSS.scrub/1` function applied its allowlist exclusively to `property: value` declaration patterns; `@import` at-rules, which are syntactically distinct, were never inspected and passed through verbatim. Three distinct bypass paths existed: bare `@import url(...)`, no-whitespace `@import"url"`, and CSS hex-escaped `@\69 mport`. No public exploit code is identified at time of analysis; a vendor patch is available as version 1.5.4.
Open redirect in html_sanitize_ex (Elixir, versions 0.3.1 through 1.5.2) allows remote attackers to force page visitors to navigate to attacker-controlled URLs by injecting `<meta http-equiv="refresh">` elements that the HTML5 scrubber (HtmlSanitizeEx.Scrubber.HTML5) passes through intact into sanitized output. Because a meta refresh acts at document scope rather than fragment scope, it overrides the host page's navigation regardless of where the sanitized fragment is embedded. The CVE description explicitly rules out JavaScript execution - this is a pure redirect primitive - and no public exploit has been identified at time of analysis.
html_sanitize_ex's HTML5 scrubber (versions 0.3.1 through 1.5.2) permits the `form` and `formaction` attributes to survive sanitization on `<input>` elements, enabling unauthenticated remote attackers to silently hijack existing page forms and redirect victim submissions - including credentials - to an attacker-controlled endpoint. The attack exploits HTML's native form association model (no script required), but succeeds only when the rendering page already contains a form with a known or guessable `id` attribute. No active exploitation or CISA KEV listing has been identified at time of analysis, and no EPSS score was included in source data.
html_sanitize_ex's HTML5 scrubber (versions 0.3.1 through before 1.5.3) passes attacker-controlled URIs through the `data` attribute of `<object>` elements after a trivially bypassed case-sensitive prefix check, allowing remote attackers to embed arbitrary external or same-origin documents into sanitized pages viewed by victims. The `<object>` tag was never registered through the library's `allow_tag_with_uri_attributes/3` URI-validation mechanism, and its sole guard - a literal lowercase `javascript:` prefix match - is defeated by mixed-case variants, `data:` URIs, protocol-relative URLs, and same-origin relative paths. No public exploit has been identified at time of analysis, and no active exploitation (CISA KEV) has been confirmed; the CVSS 4.0 score of 2.3 correctly reflects constrained real-world impact due to browser-enforced origin isolation on embedded `<object>` content.