CVE-2026-66370 Details

A URL redirection to untrusted site vulnerability, also known as an open redirect, has been identified in the HTML5 scrubber of the rrrene html_sanitize_ex package, specifically in versions 0.3.1 prior to 1.5.3. This vulnerability allows an unauthenticated remote attacker to manipulate a form already present on the rendering page. The attacker can intercept whatever the victim submits through the form, including credentials, by exploiting the form and formaction attributes of an input element in sanitized HTML. The issue arises because the form attribute can associate an input with any form on the page by its id, even if the input is outside the form. Additionally, the formaction attribute on a submit control can override the form's action, creating a potential for misuse. Notably, the scrubber in question does not allow the inclusion of form or button elements, meaning the attacker cannot create a form of their own. Instead, the vulnerability relies on the presence of a form with an id on the rendering page.

Users can update to version 1.5.3 or later, where this vulnerability has been patched. Alternatively, they can sanitize input with basic_html, markdown_html, or strip_tags, none of which allow input elements, or define a custom scrubber that excludes input elements.