Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-117645

Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
EEF

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributes_escape/1. attributes_escape/1 in lib/phoenix_html.ex escapes attribute values but not attribute names. key_escape/1 passes a binary key through html_escape, which neutralizes quotes and angle brackets but not whitespace, so a key such as x onmouseover ends the attribute and starts a new one. An atom key is only dasherized, so any character passes, including quotes and >. Nested data, aria and phx keys take the same paths. An application is affected when it builds attribute keys from untrusted input and renders them through HEEx <tag {@attrs}>, content_tag/3, or a direct call. Before 3.0.0 the same code lived in Phoenix.HTML.Tag. This issue affects phoenix_html: from 1.0.0 before 3.3.5 and from 4.0.0 before 4.4.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

phoenixframework phoenix_html

Default version status: unaffected

  • 1.0.0 to < 3.3.5affected
  • 4.0.0 to < 4.4.0affected
pkg:hex/phoenix_html

phoenixframework phoenix_html

Default version status: unaffected

  • 6ad3a1d7960891a468d54636054a98e11dfb5111 to < *affected
pkg:github/phoenixframework/phoenix_html

References