CVE-2026-66370 html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking

[
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "Elixir.HtmlSanitizeEx.Scrubber.HTML5",
      "Elixir.HtmlSanitizeEx"
    ],
    "packageName": "html_sanitize_ex",
    "packageURL": "pkg:hex/html_sanitize_ex",
    "product": "html_sanitize_ex",
    "programFiles": [
      "lib/html_sanitize_ex/scrubber/html5.ex",
      "lib/html_sanitize_ex.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.HtmlSanitizeEx.Scrubber.HTML5':scrub_attribute/2"
      },
      {
        "name": "'Elixir.HtmlSanitizeEx.Scrubber.HTML5':sanitize/1"
      },
      {
        "name": "'Elixir.HtmlSanitizeEx':html5/1"
      }
    ],
    "repo": "https://github.com/rrrene/html_sanitize_ex",
    "vendor": "rrrene",
    "versions": [
      {
        "lessThan": "1.4.5",
        "status": "affected",
        "version": "0.3.1",
        "versionType": "semver"
      },
      {
        "lessThan": "1.5.3",
        "status": "affected",
        "version": "1.5.0-rc.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "Elixir.HtmlSanitizeEx.Scrubber.HTML5",
      "Elixir.HtmlSanitizeEx"
    ],
    "packageName": "rrrene/html_sanitize_ex",
    "packageURL": "pkg:github/rrrene/html_sanitize_ex",
    "product": "html_sanitize_ex",
    "programFiles": [
      "lib/html_sanitize_ex/scrubber/html5.ex",
      "lib/html_sanitize_ex.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.HtmlSanitizeEx.Scrubber.HTML5':scrub_attribute/2"
      },
      {
        "name": "'Elixir.HtmlSanitizeEx.Scrubber.HTML5':sanitize/1"
      },
      {
        "name": "'Elixir.HtmlSanitizeEx':html5/1"
      }
    ],
    "repo": "https://github.com/rrrene/html_sanitize_ex",
    "vendor": "rrrene",
    "versions": [
      {
        "changes": [
          {
            "at": "a1e804ed997e780ea71d14393cf2f701330553a6",
            "status": "unaffected"
          },
          {
            "at": "21394e758cb0ffe12fb9953c30fdedc6016c8f9e",
            "status": "unaffected"
          }
        ],
        "lessThan": "*",
        "status": "affected",
        "version": "8976d64ea0b77d26093a94a43ec48a3978e8d028",
        "versionType": "git"
      }
    ]
  }
]