CVE-2026-66370 rrrene CVE debrief

Who should care

Developers and administrators using html_sanitize_ex versions between 0.3.1 and 1.5.3 should be aware of this vulnerability and take steps to mitigate it. Additionally, security teams monitoring for potential open redirect attacks should be informed of this issue.

Technical summary

The html_sanitize_ex library, versions from 0.3.1 to before 1.5.3, is vulnerable to a URL Redirection to Untrusted Site issue. This occurs because the library does not properly sanitize the form and formaction attributes in HTML, allowing attackers to redirect users to malicious sites. An attacker can exploit this by targeting a form on a page that has an id, using the form and formaction attributes on an input element in sanitized HTML.

Defensive priority

Medium priority given the CVSS score of 4.8 and the potential for attackers to retarget forms on a page.

Recommended defensive actions

• Inventory and assess all systems using html_sanitize_ex versions between 0.3.1 and 1.5.3 to identify potential exposure.
• Apply the latest version of html_sanitize_ex (1.5.3 or higher) to address the vulnerability.
• Implement compensating controls such as monitoring for suspicious form submissions and ensuring proper input validation.
• Educate developers on secure coding practices, especially regarding input validation and sanitization.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE-2026-66370 issue arises from the html_sanitize_ex library, versions from 0.3.1 to before 1.5.3, which improperly handles the form and formaction attributes in sanitized HTML, allowing for URL redirection to an untrusted site. This vulnerability requires the rendering page to already contain a form with an id that an attacker can target.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.