CVE-2026-66353: Doggo vulnerable to cross-site scripting via unescaped date field values
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woylie doggo allows Reflected XSS.
Doggo.normalizevalue/2 in lib/doggo.ex returned date field values wrapped in {:safe, ...}, the Phoenix.HTML marker meaning "already escaped, emit verbatim", without escaping them, so the value reached the value attribute of the <input> rendered by the field component unchanged. Any application rendering <.field type="date"> over user-controlled params is affected through the ordinary Phoenix form round-trip, where a failed validation re-renders the submitted value. The pattern kept exactly the first ten bytes and discarded shorter values, capping a payload at ten bytes: enough to terminate the attribute and open an element or attach a short event handler, not enough to place attacker-chosen script inline. Only type="date" is affected.
This issue affects doggo: from 0.1.0 before 0.14.8.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using doggo versions from 0.1.0 before 0.14.8 are affected only if they render a <.field type="date"> component with a value derived from user-controlled parameters. Other field types are not affected.
What must an attacker do to trigger the XSS?
An attacker must submit a crafted value for a date field and cause the application to re-render that submitted value, such as through a failed form validation. The vulnerable form round-trip then emits the unescaped value in the input element's value attribute.
Are default date-field forms affected?
A date field is affected when its rendered value comes from user-controlled params during a re-render. The issue is not described as affecting date fields whose values are not sourced from attacker-controlled input.
What limits apply to an exploit payload?
Doggo retained only the first ten bytes of the submitted value and discarded shorter values. This can be enough to terminate the attribute and open an element or attach a short event handler, but not enough to include attacker-chosen inline script.