Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-117645— Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1

Quick assessment

Affected
phoenixframework phoenix_html
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Phoenix Framework 的 组件中存在“网页生成过程中输入未正确中和（跨站脚本攻击，XSS）”漏洞。该漏洞允许能够控制属性名称的攻击者，通过 函数向渲染后的 HTML 中注入恶意属性及脚本。 具体而言， 中的 函数仅对属性值进行转义，而未对属性名进行转义。 函数将二进制键值传递给 ，该函数会中和引号和尖括号，但不会处理空白字符。因此，类似 的键值会终止当前属性并开启一个新的属性。对于原子（atom）类型的键，仅会进行连字符化（dasherize）处理，导致包括引号和 在内的任何字符均可直接通过。嵌套的

CVSS 5.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-117645

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributes_escape/1. attributes_escape/1 in lib/phoenix_html.ex escapes attribute values but not attribute names. key_escape/1 passes a binary key through html_escape, which neutralizes quotes and angle brackets but not whitespace, so a key such as x onmouseover ends the attribute and starts a new one. An atom key is only dasherized, so any character passes, including quotes and >. Nested data, aria and phx keys take the same paths. An application is affected when it builds attribute keys from untrusted input and renders them through HEEx <tag {@attrs}>, content_tag/3, or a direct call. Before 3.0.0 the same code lived in Phoenix.HTML.Tag. This issue affects phoenix_html: from 1.0.0 before 3.3.5 and from 4.0.0 before 4.4.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
phoenixframework phoenix_html 1.0.0 ~ 3.3.5 cpe:2.3:a:phoenixframework:phoenix_html:*:*:*:*:*:*:*:*
phoenixframework phoenix_html 6ad3a1d7960891a468d54636054a98e11dfb5111 ~ * cpe:2.3:a:phoenixframework:phoenix_html:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-117645

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-117645

请登录查看更多情报信息。

Other References for CVE-2026-117645 (5)

IV. Related Vulnerabilities

Same vendor: phoenixframework
Same weakness: CWE-79