CVE-2026-117645

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phoenixframework phoenixhtml allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributesescape/1. attributesescape/1 in...

CVE-2026-117645

The phoenix_html component of the phoenixframework is vulnerable to Cross-site Scripting (XSS) via attribute injection. The root cause is that attributes_escape/1 fails to validate or escape attribute names; specifically, key_escape/1 only neutralizes quotes and angle brackets but allows whitespa...

EUVD-2026-114454

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phoenixframework phoenixhtml allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributesescape/1. attributesescape/1 in...

CVE-2026-117645 Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phoenixframework phoenixhtml allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributesescape/1. attributesescape/1 in...

EEF-CVE-2026-117645 Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1

Summary Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phoenixframework phoenixhtml allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributesescape/1. attributesescape/1 in...

CVE-2026-117645 Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phoenixframework phoenixhtml allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributesescape/1. attributesescape/1 in...

CVE-2026-117645: phoenixframework phoenix_html: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phoenixframework phoenixhtml allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributesescape/1. attributesescape/1 in...