AIKIDO-2026-49867
html_sanitize_ex is vulnerable to URL Redirection to Untrusted Site ('Open Redirect')
48
Medium Risk
This Affects:
html_sanitize_exTL;DR
The HTML5 scrubber allows the form and formaction attributes on an input element without validating their scheme. The HTML form attribute binds an input to any form on the page by its id, and formaction overrides that form's submit target, so an absolute cross-origin URL survives sanitizing and can retarget a submitted form and its data off-site. The fix applies scheme validation so cross-origin form and formaction targets no longer pass.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the HtmlSanitizeEx.html5/1 scrubber, or a custom scrubber extending :html5, and render the sanitized output on a page that already contains a form with an id.
Background info
html_sanitize_ex is vulnerable to URL Redirection to Untrusted Site ('Open Redirect') in versions 0.3.1 - 1.5.2.
How to fix this
Upgrade the html_sanitize_ex library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant