CVE-2026-66829

The CVE affects html_sanitize_ex (HtmlSanitizeEx.html5/1) where attacker-supplied meta refresh elements survive sanitization. The root cause is that a meta element can apply document-wide directives, enabling open redirects to user-chosen sites via a tag. Affected versions: html_sanitize_ex from...