Phoenix Html
Monthly
Cross-site scripting in phoenix_html (from 1.0.0 before 3.3.5, and from 4.0.0 before 4.4.0) allows attackers who control HTML attribute names to break out of an attribute and inject new attributes or script into rendered markup. Only attribute keys are mishandled - attribute values are escaped correctly - so applications are exposed solely when they derive attribute names from untrusted input and render them through HEEx <tag {@attrs}>, content_tag/3, or a direct Phoenix.HTML.attributes_escape/1 call (before 3.0.0 the same code lived in Phoenix.HTML.Tag). No public exploit identified at time of analysis; the victim must load the rendered page, and vendor fixes are available in 3.3.5 and 4.4.0.
Cross-site scripting in phoenix_html (from 1.0.0 before 3.3.5, and from 4.0.0 before 4.4.0) allows attackers who control HTML attribute names to break out of an attribute and inject new attributes or script into rendered markup. Only attribute keys are mishandled - attribute values are escaped correctly - so applications are exposed solely when they derive attribute names from untrusted input and render them through HEEx <tag {@attrs}>, content_tag/3, or a direct Phoenix.HTML.attributes_escape/1 call (before 3.0.0 the same code lived in Phoenix.HTML.Tag). No public exploit identified at time of analysis; the victim must load the rendered page, and vendor fixes are available in 3.3.5 and 4.4.0.