AIKIDO-2026-182225
html_sanitize_ex is vulnerable to URL Redirection to Untrusted Site ('Open Redirect')
23
Low Risk
This Affects:
html_sanitize_exTL;DR
The HTML5 scrubber keeps meta elements in its sanitized output. Because a meta refresh acts on the whole document rather than the embedded fragment, sanitized content can navigate a visitor to an external site or declare document-wide directives such as a Content-Security-Policy. Filtering only lowercase schemes does not prevent the redirect, though it does not by itself yield script execution. The fix sanitizes meta elements.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the HtmlSanitizeEx.html5/1 scrubber, or a custom scrubber extending :html5, and render the sanitized output to other users.
Background info
html_sanitize_ex is vulnerable to URL Redirection to Untrusted Site ('Open Redirect') in versions 0.3.1 - 1.5.2.
How to fix this
Upgrade the html_sanitize_ex library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant