CVE-2026-66829 in html_sanitize_ex
Summary
by MITRE • 08/06/2026
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a <meta http-equiv="refresh"> element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied <meta> elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy.
This is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated.
This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability described represents a classic open redirect flaw that specifically targets the HTML5 scrubber functionality within the rrrene html_sanitize_ex library. This type of vulnerability falls under CWE-601, which categorizes URL redirection to untrusted sites as a security weakness where applications fail to properly validate or sanitize user-supplied URLs in redirect scenarios. The issue manifests when the html_sanitize_ex library processes HTML content containing meta refresh elements, allowing malicious actors to inject potentially harmful redirects that can lead users away from legitimate websites toward attacker-controlled domains.
The technical implementation of this vulnerability exploits the library's handling of HTML meta elements during the sanitization process. Specifically, the html_sanitize_ex.html5/1 component retains attacker-supplied <meta> elements in its output without adequate validation or sanitization of their attributes. When a malicious user injects a meta refresh element with a redirect URL, the sanitizer fails to properly filter or neutralize this dangerous content, allowing it to persist in the sanitized output. This behavior creates an attack vector where the attacker can manipulate browser navigation through document-wide directives rather than just fragment-specific elements.
The operational impact of this vulnerability extends beyond simple redirection attacks and can be leveraged for more sophisticated social engineering campaigns. The meta refresh element operates at the document level, meaning it affects the entire page context rather than just a specific fragment, which allows attackers to inject comprehensive page directives including Content-Security-Policy headers that could further compromise user security. This characteristic makes the vulnerability particularly dangerous as it provides attackers with multiple attack surfaces beyond simple URL redirection. The vulnerability exists in versions from 0.3.1 through 1.5.2, representing a significant window of exposure where affected applications could be exploited.
The security implications of this flaw align with ATT&CK technique T1566.001, which covers "Phishing: Spearphishing Attachment" and the broader category of social engineering attacks that leverage web-based redirection to compromise user trust and access. Unlike traditional cross-site scripting vulnerabilities where malicious code execution occurs through JavaScript payloads, this particular vulnerability operates within the constraints of HTML meta refresh capabilities and does not allow for direct script execution. The browser's security model prevents javascript: URLs from being executed through meta refresh elements, which means the attack vector is limited to HTTP redirects rather than code injection.
Organizations utilizing affected versions of html_sanitize_ex should implement immediate mitigations including upgrading to version 1.5.3 or later where this vulnerability has been addressed. Additionally, administrators should consider implementing additional input validation measures at the application level to prevent unsanitized user content from being processed through the vulnerable library. The fix typically involves strengthening the sanitization logic to properly filter meta refresh elements or remove them entirely during the HTML processing pipeline, ensuring that only safe and expected attributes are preserved in the output.