Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

html_sanitize_ex

6 known vulnerabilities (2 high, 1 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 2 high, 1 medium, 3 low
Registry
Hex

Advisories 6

  • Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service

    Affected: from 0.3.1, fixed in 1.4.5; from 1.5.0-rc.0, fixed in 1.5.3; from 0.3.1, fixed in 1.4.5; from 1.5.0-rc.0, fixed in 1.5.3.

  • Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service

    Affected: from 0.3.1, fixed in 1.4.5; from 1.5.0-rc.0, fixed in 1.5.3; from 0.3.1, fixed in 1.4.5; from 1.5.0-rc.0, fixed in 1.5.3.

  • CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

    Affected: from 0.3.1, fixed in 1.4.5; from 1.5.0-rc.0, fixed in 1.5.4; from 0.3.1, fixed in 1.4.5; from 1.5.0-rc.0, fixed in 1.5.4.

  • html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection

    Affected: from 0.3.1, fixed in 1.4.5; from 1.5.0-rc.0, fixed in 1.5.3; from 0.3.1, fixed in 1.4.5; from 1.5.0-rc.0, fixed in 1.5.3.

  • CVE-2026-66370Medium 4.8

    html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking

    Affected: from 0.3.1, fixed in 1.4.5; from 1.5.0-rc.0, fixed in 1.5.3; from 0.3.1, fixed in 1.4.5; from 1.5.0-rc.0, fixed in 1.5.3.

  • html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding

    Affected: from 0.3.1, fixed in 1.4.5; from 1.5.0-rc.0, fixed in 1.5.3; from 0.3.1, fixed in 1.4.5; from 1.5.0-rc.0, fixed in 1.5.3.