AIKIDO-2026-274638

pagy is vulnerable to HTML Injection

HTML Injection Pre-CVE Published Jul 21, 2026

Low Risk

This Affects:

pagy

1.0.0 - 43.6.0

Fixed in 43.6.1

Are you affected? Scan for Free

TL;DR

pagy builds pagination link href attributes by interpolating a composed query string directly into HTML without HTML-escaping it. Because the & separators between query parameters are emitted raw, an HTML parser can decode a following parameter name that begins with a legacy named character reference as an HTML entity. Reflected untrusted request parameters can therefore change the parsed link URL and the parameters a victim sends when following a pagination link. The fix HTML-escapes the composed URL with CGI.escapeHTML before placing it in the href attribute.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application reflects untrusted request parameters into pagy pagination links.