CVE-2026-117645 in phoenix_html
Summary
by MITRE • 10/30/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributes_escape/1.
attributes_escape/1 in lib/phoenix_html.ex escapes attribute values but not attribute names. key_escape/1 passes a binary key through html_escape, which neutralizes quotes and angle brackets but not whitespace, so a key such as x onmouseover ends the attribute and starts a new one. An atom key is only dasherized, so any character passes, including quotes and >. Nested data, aria and phx keys take the same paths. An application is affected when it builds attribute keys from untrusted input and renders them through HEEx <tag {@attrs}>, content_tag/3, or a direct call. Before 3.0.0 the same code lived in Phoenix.HTML.Tag.
This issue affects phoenix_html: from 1.0.0 before 3.3.5 and from 4.0.0 before 4.4.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified as Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting or XSS, resides within the phoenix_html library used in Phoenix Framework applications. This specific flaw stems from an asymmetry in how input is processed during HTML attribute generation. The function attributes_escape/1, which is responsible for sanitizing data before it is rendered into HTML, correctly escapes attribute values to prevent injection through value strings. However, it fails to adequately sanitize the keys or names of these attributes. This oversight creates a pathway for attackers who can control the structure of input data that gets converted into HTML attributes to inject malicious scripts directly into the page context.
The technical root cause lies in the implementation of key_escape/1 within lib/phoenix_html.ex. While this function applies html_escape to binary keys, thereby neutralizing dangerous characters like quotes and angle brackets, it does not process whitespace or other control characters that are critical for attribute parsing logic. Consequently, if an attacker supplies a key such as x onmouseover, the lack of whitespace sanitization allows the space character to remain intact in the output HTML. This effectively terminates the intended attribute and initiates a new one with a malicious event handler like onmouseover, which can then execute arbitrary JavaScript code when triggered by user interaction or page load events.
The vulnerability is further exacerbated by how different types of keys are handled within the framework. When an atom key is used instead of a binary string, it undergoes only dasherization, meaning any character including quotes and greater-than signs passes through without additional validation. This behavior applies uniformly to nested data structures as well as special attribute namespaces like aria and phx. The operational impact is significant for applications that dynamically build HTML attributes from untrusted user input. If such an application renders these dynamic keys using HEEx templates, the content_tag/3 function, or a direct call to the escaping functions, it becomes susceptible to stored or reflected XSS attacks depending on how the data persists.
This security flaw affects multiple versions of the phoenix_html library, specifically those from version 1.0.0 up to but not including 3.3.5, and from version 4.0.0 up to but not including 4.4.0. Prior to version 3.0.0, this logic was located in Phoenix.HTML.Tag, meaning older applications may also be vulnerable if they have not upgraded their dependencies or patched the underlying code manually. The presence of this vulnerability allows attackers to bypass standard content security policies that rely on proper attribute separation, leading to potential session hijacking, defacement, or malware distribution through injected scripts.
To mitigate this risk, developers must ensure they are running a version of phoenix_html where the key escaping logic has been corrected to handle whitespace and special characters in keys with the same rigor as values. Upgrading to at least version 3.3.5 for the legacy branch or 4.4.0 for the current branch is essential. Additionally, application-level defenses should be implemented by validating and sanitizing any user-supplied data that influences attribute names before it reaches the rendering layer. Adhering to industry standards such as CWE-79 for Cross-site Scripting helps in identifying similar patterns of input validation failures. Furthermore, understanding how this attack vector maps to MITRE ATT&CK techniques related to client-side code injection can aid in broader security monitoring and detection strategies within the organization's infrastructure.