EUVD-2023-0339

Malicious code in bioql PyPI...

Cross-site Scripting (XSS)

phoenixhtml is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the special characters before it outputs to the front end, allowing an attacker to inject and execute malicious JavaScript via HEEx class attributes in tag.ex...

GHSA-5G2H-9X5V-5H3X phoenix_html allows Cross-site Scripting in HEEx class attributes

tag.ex in Phoenix Phoenix.HTML aka phoenixhtml before 3.0.4 allows XSS in HEEx class attributes...