rrrene html_sanitize_ex prior 1.5.3 HTML5 Scrubber formaction redirect

Summaryinfo

A vulnerability, which was classified as problematic, was found in rrrene html_sanitize_ex. Affected by this issue is some unknown functionality of the component HTML5 Scrubber. The manipulation of the argument formaction results in redirect. This vulnerability is known as CVE-2026-66370. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability classified as problematic has been found in rrrene html_sanitize_ex. Affected is some unknown functionality of the component HTML5 Scrubber. The manipulation of the argument formaction with an unknown input leads to a redirect vulnerability. CWE is classifying the issue as CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. This is going to have an impact on integrity. CVE summarizes:

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction attributes on an <input> element in sanitized HTML. HTML's form attribute associates an input with any form on the page by its id even when the input sits outside that form, and formaction on a submit control overrides the owning form's action. Neither attribute receives a scheme check, so an absolute cross-origin URL survives sanitizing. No script executes. The scrubber allows neither form nor button, so the attacker cannot introduce a form of their own and the rendering page must already contain a form carrying an id. This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-66370 since 08/06/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1204.001.

Upgrading to version 1.5.3 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• rrrene

Name

• html_sanitize_ex

Website

• Product: https://github.com/rrrene/html_sanitize_ex/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion