{"id":"CVE-2026-117645","kind":"vulnerability","aliases":["CVE-2026-117645"],"related":[],"title":"Phoenix HTML: attribute names unescaped, letting untrusted input inject scripts","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributes_escape/1.\n\nattributes_escape/1 in lib/phoenix_html.ex escapes attribute values but not attribute names. key_escape/1 passes a binary key through html_escape, which neutralizes quotes and angle brackets but not whitespace, so a key such as x onmouseover ends the attribute and starts a new one. An atom key is only dasherized, so any character passes, including quotes and >. Nested data, aria and phx keys take the same paths. An application is affected when it builds attribute keys from untrusted input and renders them through HEEx <tag {@attrs}>, content_tag/3, or a direct call. Before 3.0.0 the same code lived in Phoenix.HTML.Tag.\n\nThis issue affects phoenix_html: from 1.0.0 before 3.3.5 and from 4.0.0 before 4.4.0.","summary":"Phoenix.HTML.attributes_escape/1 escapes attribute values but not attribute names, so a key containing whitespace or quotes can end an attribute and start a new one. An attacker who controls attribute keys can inject event handlers and script into rendered pages.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elixir","package","phoenix","phoenix-html"],"not_affected_if":["attribute-keys-hardcoded","fixed-version"],"how_to_check":"- Look for `phoenix_html` in `mix.lock` and check the resolved version.\n- Search the codebase for HEEx `{@attrs}` spreads, `content_tag/3` and direct `attributes_escape` calls where attribute keys come from user input.","fix":"- `phoenix_html` from `3.3.5` in the 1.x/3.x line\n- `phoenix_html` from `4.4.0` in the 4.x line","status":"open","published_at":"2026-10-30T21:16:51+00:00","first_seen_at":"2026-10-30T21:25:52+00:00","triaged_at":"2026-10-30T21:27:00+00:00","updated_at":"2026-10-30T21:27:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T21:27:00Z","model":"claude-haiku-5-5","output":{"fix":"- `phoenix_html` from `3.3.5` in the 1.x/3.x line\n- `phoenix_html` from `4.4.0` in the 4.x line","reach":"internet","title":"Phoenix HTML: attribute names unescaped, letting untrusted input inject scripts","impact":"medium","summary":"Phoenix.HTML.attributes_escape/1 escapes attribute values but not attribute names, so a key containing whitespace or quotes can end an attribute and start a new one. An attacker who controls attribute keys can inject event handlers and script into rendered pages.","audience":"developers","category":"package","nicknames":[],"who_cares":["phoenix","elixir","phoenix-html"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker injects script into rendered pages, running in users' browsers","analyst_note":"","how_to_check":"- Look for `phoenix_html` in `mix.lock` and check the resolved version.\n- Search the codebase for HEEx `{@attrs}` spreads, `content_tag/3` and direct `attributes_escape` calls where attribute keys come from user input.","plain_action":"","needs_analyst":false,"not_affected_if":["attribute-keys-hardcoded","fixed-version"],"who_is_affected":"Applications that build HTML attribute names from untrusted input and render them through HEEx attribute spreads, content_tag/3 or direct attributes_escape calls. Versions from 1.0.0 before 3.3.5 and from 4.0.0 before 4.4.0 are affected. Apps whose attribute keys are fixed in code, not user-controlled, are not exposed by this flaw.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000751,"input_tokens":4395,"output_tokens":622,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117645':13A,16A '-2026':12A,15A '1.0.0':204C '3.0.0':191C '3.3.5':206C '4.0.0':209C '4.4.0':211C 'affect':168C,200C 'allow':80C 'angl':122C 'applic':166C 'aria':157C 'atom':143C 'attack':49B,82C 'attr':183C 'attribut':3A,26B,30B,42B,52B,85C,89C,98C,103C,107C,136C,172C 'binari':113C 'bracket':123C 'build':171C 'call':189C 'charact':150C 'code':194C 'contain':35B 'content':184C 'control':51B,84C 'cross':72C 'cross-sit':71C 'cve':11A,14A 'dasher':147C 'data':156C 'direct':188C 'elixir':17B 'end':40B,134C 'escap':25B,102C,117C 'escape/1':24B,97C,99C,110C 'event':56B 'generat':70C 'handler':57B 'heex':181C 'html':2A,22B,79C,94C,116C,202C 'improp':63C 'includ':152C 'inject':9A,55B,88C 'input':8A,66C,176C 'issu':199C 'key':34B,53B,109C,114C,129C,144C,160C,173C 'let':6A 'lib/phoenix_html.ex':101C 'live':195C 'name':4A,31B,86C,108C 'nest':155C 'neutral':64C,119C 'new':46B,140C 'one':47B,141C 'onmouseov':133C 'packag':18B 'page':62B,69C 'pass':111C,151C 'path':164C 'phoenix':1A,19B,21B,78C,201C 'phoenix-html':20B 'phoenix.html.attributes':23B,96C 'phoenix.html.tag':197C 'phoenixframework':77C 'phx':159C 'quot':38B,120C,153C 'render':61B,93C,178C 'script':10A,59B,74C,91C 'site':73C 'start':44B,138C 'tag':182C 'tag/3':185C 'take':161C 'unescap':5A 'untrust':7A,175C 'valu':27B,104C 'via':95C 'vulner':75C 'web':68C 'whitespac':36B,126C 'x':132C","nicknames":[],"mitigations":[],"who_affected":"Applications that build HTML attribute names from untrusted input and render them through HEEx attribute spreads, content_tag/3 or direct attributes_escape calls. Versions from 1.0.0 before 3.3.5 and from 4.0.0 before 4.4.0 are affected. Apps whose attribute keys are fixed in code, not user-controlled, are not exposed by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T21:16:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117645","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117645","severity":null,"published_at":"2026-10-30T21:16:51+00:00","modified_at":"2026-10-30T21:16:51+00:00","first_seen_at":"2026-10-30T21:25:52+00:00","fetched_at":"2026-10-30T21:25:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}