Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-66829— html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection

Quick assessment

Affected

rrrene html_sanitize_ex

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

rrrene html sanitize ex是rrrene个人开发者的一个HTML净化工具。 rrrene html sanitize ex 0.3.1版本至1.5.3之前版本存在输入验证错误漏洞，该漏洞源于HTML5 scrubber在清理后的HTML中保留了攻击者提供的<meta>元素，可能导致远程攻击者通过<meta http-equiv="refresh">元素强制页面访问者导航到攻击者选择的站点。

CVSS 2.3 · Low EPSS 0.57% · P46 Updated Aug 19, 2026

Possible ATT&CK Techniques 2 AI

T1132 · Data Encoding T1189 · Drive-by Compromise

Affected Version Matrix 3

Vendor	Product	Version Range	Status
rrrene	html_sanitize_ex	`0.3.1< 1.4.5`	affected
		`1.5.0-rc.0< 1.5.3`	affected
		`8976d64ea0b77d26093a94a43ec48a3978e8d028< *`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-66829

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection

Source: CVE Program / CVE List V5

Vulnerability Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a <meta http-equiv="refresh"> element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied <meta> elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy. This is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

指向未可信站点的URL重定向(开放重定向)

Source: CVE Program / CVE List V5

Vulnerability Title

rrrene html sanitize ex 输入验证错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
rrrene	html_sanitize_ex	0.3.1 ~ 1.4.5	`cpe:2.3:a:rrrene:html_sanitize_ex::::::::`
rrrene	html_sanitize_ex	8976d64ea0b77d26093a94a43ec48a3978e8d028 ~ *	`cpe:2.3:a:rrrene:html_sanitize_ex::::::::`

II. Public POCs for CVE-2026-66829

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-66829

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-66829 (2)

Vendor Advisories for CVE-2026-66829 (2)

🔗 Page not found · GitHub · GitHub vendor-advisory related
🔗 EEF-CVE-2026-66829 - OSV related

Other References for CVE-2026-66829 (1)

🔗 CVE-2026-66829 related

https://www.cve.org/CVERecord?id=CVE-2026-66829

Same Patch Batch · rrrene · 2026-08-06 · 6 CVEs total

CVE-2026-68749	8.2 HIGH	Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion de
CVE-2026-68750	8.2 HIGH	Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaus
CVE-2026-66370	4.8 MEDIUM	html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allow
CVE-2026-66843	2.3 LOW	html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untr
CVE-2026-68747	2.3 LOW	CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

IV. Related Vulnerabilities

Same product: html_sanitize_ex

Same vendor: rrrene

Same weakness: CWE-601