AIKIDO-2026-49867
html_sanitize_ex is vulnerable to URL Redirection to Untrusted Site ('Open Redirect')
48
CVE Score
Medium
URL Redirection to Untrusted Site ('Open Redirect')
TL;DR
The HTML5 scrubber allows the form and formaction attributes on an input element without validating their scheme. The HTML form attribute binds an input to any form on the page by its id, and formaction overrides that form's submit target, so an absolute cross-origin URL survives sanitizing and can retarget a submitted form and its data off-site. The fix applies scheme validation so cross-origin form and formaction targets no longer pass.
How do I fix this?
Upgrade the html_sanitize_ex library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the HtmlSanitizeEx.html5/1 scrubber, or a custom scrubber extending :html5, and render the sanitized output on a page that already contains a form with an id.
Package
Versions
0.3.1 - 1.5.2
Fixed in 1.5.3Background info
html_sanitize_ex is vulnerable to URL Redirection to Untrusted Site ('Open Redirect') in versions 0.3.1 - 1.5.2.
Links
GitHub Release
Fix Commits
github.com/rrrene/html_sanitize_ex/commit/21394e758cb0ffe12fb9953c30fdedc6016c8f9egithub.com/rrrene/html_sanitize_ex/commit/a1e804ed997e780ea71d14393cf2f701330553a6
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.