CVE-2026-66829 html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection

[
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "Elixir.HtmlSanitizeEx.Scrubber.HTML5",
      "Elixir.HtmlSanitizeEx"
    ],
    "packageName": "html_sanitize_ex",
    "packageURL": "pkg:hex/html_sanitize_ex",
    "product": "html_sanitize_ex",
    "programFiles": [
      "lib/html_sanitize_ex/scrubber/html5.ex",
      "lib/html_sanitize_ex.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.HtmlSanitizeEx.Scrubber.HTML5':scrub_attribute/2"
      },
      {
        "name": "'Elixir.HtmlSanitizeEx.Scrubber.HTML5':sanitize/1"
      },
      {
        "name": "'Elixir.HtmlSanitizeEx':html5/1"
      }
    ],
    "repo": "https://github.com/rrrene/html_sanitize_ex",
    "vendor": "rrrene",
    "versions": [
      {
        "lessThan": "1.5.3",
        "status": "affected",
        "version": "0.3.1",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "Elixir.HtmlSanitizeEx.Scrubber.HTML5",
      "Elixir.HtmlSanitizeEx"
    ],
    "packageName": "rrrene/html_sanitize_ex",
    "packageURL": "pkg:github/rrrene/html_sanitize_ex",
    "product": "html_sanitize_ex",
    "programFiles": [
      "lib/html_sanitize_ex/scrubber/html5.ex",
      "lib/html_sanitize_ex.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.HtmlSanitizeEx.Scrubber.HTML5':scrub_attribute/2"
      },
      {
        "name": "'Elixir.HtmlSanitizeEx.Scrubber.HTML5':sanitize/1"
      },
      {
        "name": "'Elixir.HtmlSanitizeEx':html5/1"
      }
    ],
    "repo": "https://github.com/rrrene/html_sanitize_ex",
    "vendor": "rrrene",
    "versions": [
      {
        "lessThan": "9f7e38be51edc38f132dfe994f37af5cf5e0e76f",
        "status": "affected",
        "version": "8976d64ea0b77d26093a94a43ec48a3978e8d028",
        "versionType": "git"
      }
    ]
  }
]