Cross-site Scripting Vulnerability in Phoenix HTML by Phoenix Framework
CVE-2026-117645

5.3MEDIUM

Key Information:

Vendor

Phoenixframework

Status
Phoenix Html
Vendor
CVE Published:
30 October 2026

What is CVE-2026-117645?

A Cross-site Scripting (XSS) vulnerability exists in the phoenix_html library of the Phoenix Framework. This flaw arises from improper neutralization of input during web page generation. Specifically, the attributes_escape/1 function is designed to escape attribute values; however, it fails to properly handle attribute names. As a result, an attacker who controls the names of attributes may inject malicious scripts into rendered HTML. This issue is particularly concerning for applications that construct attribute keys from untrusted input, which can lead to significant security risks. Versions of phoenix_html prior to 3.3.5 and those from 4.0.0 to 4.4.0 are known to be affected. Developers are advised to review the implementation and apply the necessary patches.

Affected Version(s)

phoenix_html 1.0.0 < 3.3.5

phoenix_html 4.0.0 < 4.4.0

phoenix_html 6ad3a1d7960891a468d54636054a98e11dfb5111

References

https://cna.erlef.org/cves/CVE-2026-117645.html
relatedthird-party-advisory
https://osv.dev/vulnerability/EEF-CVE-2026-117645
related
https://github.com/phoenixframework/phoenix_html/commit/6...
related

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrew Moore
Andrew Moore
Steffen Deusch
Jonatan Männchen / EEF
.