CVE-2026-66829: html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a <meta http-equiv="refresh"> element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied <meta> elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy.
This is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated.
This issue affects htmlsanitizeex: from 0.3.1 before 1.5.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66829?
CVE-2026-66829 has a risk rating of 23.
What is CVE-2026-66829?
CVE-2026-66829 is a vulnerability that allows an attacker to force users to navigate to unauthorized sites via a meta refresh element in sanitized HTML.
How do I fix CVE-2026-66829?
To fix CVE-2026-66829, update to the latest version of the rrrene/html_sanitize_ex library that addresses this vulnerability.
What impact does CVE-2026-66829 have on users?
CVE-2026-66829 can lead to forced redirection to untrusted sites, potentially resulting in phishing or other malicious activities.
Is CVE-2026-66829 an active threat?
While specific exploitation details are not provided, CVE-2026-66829 poses a real risk due to its open redirect capabilities.