Live › vulnerability › CVE-2026-117645
Phoenix.HTML.attributes_escape/1 escapes attribute values but not attribute names, so a key containing whitespace or quotes can end an attribute and start a new one. An attacker who controls attribute keys can inject event handlers and script into rendered pages.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 21:25 UTC. All times on this page are UTC.
Applications that build HTML attribute names from untrusted input and render them through HEEx attribute spreads, content_tag/3 or direct attributes_escape calls. Versions from 1.0.0 before 3.3.5 and from 4.0.0 before 4.4.0 are affected. Apps whose attribute keys are fixed in code, not user-controlled, are not exposed by this flaw.
No product ranges from the sources yet.
phoenix_html in mix.lock and check the resolved version.{@attrs} spreads, content_tag/3 and direct attributes_escape calls where attribute keys come from user input.phoenix_html from in the 1.x/3.x line3.3.5phoenix_html from 4.4.0 in the 4.x lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributes_escape/1.
attributes_escape/1 in lib/phoenix_html.ex escapes attribute values but not attribute names. key_escape/1 passes a binary key through html_escape, which neutralizes quotes and angle brackets but not whitespace, so a key such as x onmouseover ends the attribute and starts a new one. An atom key is only dasherized, so any character passes, including quotes and >. Nested data, aria and phx keys take the same paths. An application is affected when it builds attribute keys from untrusted input and renders them through HEEx <tag {@attrs}>, content_tag/3, or a direct call. Before 3.0.0 the same code lived in Phoenix.HTML.Tag.
This issue affects phoenix_html: from 1.0.0 before 3.3.5 and from 4.0.0 before 4.4.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-117645")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.