EUVD-2026-67237

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in woylie doggo allows Reflected XSS. Doggo.normalizevalue/2 in lib/doggo.ex returned date field values wrapped in :safe, ..., the Phoenix.HTML marker meaning "already escaped, emit verbatim", without...

CVE-2026-66353

woylie doggo (an Elixir/Phoenix ecosystem library) contains a Reflected XSS in Doggo.normalize_value/2 (lib/doggo.ex), which returned date field values wrapped in the {:safe, ...} Phoenix.HTML marker without escaping them, causing unescaped user input to reach the value attribute of during form ...