CVE-2026-66829 Details
Description
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a <meta http-equiv="refresh"> element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied <meta> elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy. This is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.
A URL redirection vulnerability, allowing open redirects, has been identified in the HTML5 scrubber of the rrrene html_sanitize_ex library, specifically in versions 0.3.1 prior to 1.5.3. This vulnerability enables remote attackers to manipulate sanitized HTML by injecting a <meta http-equiv="refresh"> element, causing users to be redirected to an external site of the attacker's choice. The HTML5 scrubber retains these injected <meta> elements, which can influence the entire document, including critical directives like Content-Security-Policy. Notably, this issue does not involve cross-site scripting, as browsers do not execute scripts from javascript: URLs when redirected via a meta refresh.
Users can update to html_sanitize_ex version 1.5.4 or later, where this vulnerability has been fixed. Alternatively, the vulnerability can be mitigated by using the basic_html, markdown_html, or strip_tags functions, which do not allow meta elements, or by creating a custom scrubber that excludes them.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-66829.html | EEF | PatchThird Party Advisory |
| https://github.com/rrrene/html_sanitize_ex/commit/29454dc99513fd9b5b6429ab7b6695ad09889227 | EEF | |
| https://github.com/rrrene/html_sanitize_ex/commit/9f7e38be51edc38f132dfe994f37af5cf5e0e76f | EEF | Patch |
| https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-2c6f-3j54-xpcr | EEF | Broken Link |
| https://osv.dev/vulnerability/EEF-CVE-2026-66829 | EEF | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | EEF |
Affected Products
| Product | Versions |
|---|---|
| rrrene htmlsanitizeex | >= 0.3.1, < 1.5.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 19, 2026 | CVE Modified | EEF |
| Aug 11, 2026 | Initial Analysis | [email protected] |
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | EEF |