CVE-2021-46871 in Phoenix.HTML
Summary
by MITRE • 01/10/2023
tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/09/2025
The vulnerability identified as CVE-2021-46871 affects the Phoenix.HTML library within the Phoenix web framework, specifically impacting versions prior to 3.0.4. This issue resides in the tag.ex component which handles HTML tag generation and processing. The vulnerability manifests when processing HEEx class attributes, which are used to define CSS classes for HTML elements within Phoenix's templating system. The problem occurs during the sanitization and rendering process where user-supplied input containing malicious script content can bypass security checks and be executed as part of the HTML output.
This cross-site scripting vulnerability stems from insufficient input validation and sanitization within the HTML attribute processing pipeline. When developers use HEEx templates to generate HTML elements with dynamic class attributes, the framework fails to properly escape or validate potentially malicious content that might be included in these attributes. The flaw allows attackers to inject malicious scripts that execute in the context of the victim's browser when the affected page is rendered, making it particularly dangerous in applications where user input is processed through the templating system.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to perform a wide range of malicious activities including session hijacking, data exfiltration, and redirection to malicious sites. The vulnerability affects any Phoenix application using HEEx templates with dynamic class attributes, making it a significant concern for organizations relying on the framework for web application development. Given that Phoenix is widely used for building robust web applications, the potential attack surface is substantial, particularly in applications that handle user-provided content in their templates.
Security professionals should note that this vulnerability aligns with CWE-79, which describes cross-site scripting flaws in web applications. The ATT&CK framework categorizes this under T1566.001 - Phishing, as attackers can leverage XSS to craft malicious web pages that trick users into executing harmful code. The vulnerability also relates to T1059.001 - Command and Scripting Interpreter, as the injected scripts can execute arbitrary commands within the victim's browser context. Organizations should prioritize updating their Phoenix.HTML dependencies to version 3.0.4 or later, as this release includes proper input sanitization measures that prevent malicious content from being rendered in class attributes.
Mitigation strategies should include immediate patching of the affected library version, implementing comprehensive input validation for all user-provided content used in HEEx templates, and conducting security reviews of existing applications to identify potential exposure points. Additionally, organizations should consider implementing Content Security Policy headers as an additional defense-in-depth measure, though this alone may not prevent the specific XSS vector described in CVE-2021-46871. Regular security testing and monitoring of web application outputs can help identify potential exploitation attempts and ensure that the patch has been properly implemented across all application components.