Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
Impact
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributes_escape/1.
Source excerpt · EEFWhat to do
Do not derive attribute names from untrusted input. Where dynamic attribute keys are needed, check each key against an allow list, or against a pattern such as ^[a-zA-Z][a-zA-Z0-9:._-]*$, before passing the map to attributes_escape/1 or a HEEx {@attrs} expression. Do not create atoms from request data.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
phoenixframework · EEF
phoenix_html
2 ranges
phoenixframework · EEF
phoenix_html
Package identity
pkg:hex/phoenix_htmlExplore phoenix_html →Identity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
1.0.0 → before 3.3.5
semver versions
4.0.0 → before 4.4.0
semver versions
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:phoenixframework:phoenix_html:*:*:*:*:*:*:*:*phoenixframework · EEF
phoenix_html
1 range
phoenixframework · EEF
phoenix_html
Package identity
pkg:github/phoenixframework/phoenix_htmlIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
6ad3a1d7960891a468d54636054a98e11dfb5111 → before *
git versions
From d9e4e6b2d9be49e25fb6d6b4fdbb2008174f01a6: unaffected
From a47dc8944a773b7e9273d9691dc6744ec793f1de: unaffected
Source order retained; this version scheme requires manual review.
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:phoenixframework:phoenix_html:*:*:*:*:*:*:*:*Original source description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributes_escape/1.
attributes_escape/1 in lib/phoenix_html.ex escapes attribute values but not attribute names. key_escape/1 passes a binary key through html_escape, which neutralizes quotes and angle brackets but not whitespace, so a key such as x onmouseover ends the attribute and starts a new one. An atom key is only dasherized, so any character passes, including quotes and >. Nested data, aria and phx keys take the same paths. An application is affected when it builds attribute keys from untrusted input and renders them through HEEx <tag {@attrs}>, content_tag/3, or a direct call. Before 3.0.0 the same code lived in Phoenix.HTML.Tag.
This issue affects phoenix_html: from 1.0.0 before 3.3.5 and from 4.0.0 before 4.4.0.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-117645View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
EEF · platform conditions
All conditions must hold
Any condition may hold
Vulnerable product
cpe:2.3:a:phoenixframework:phoenix_html:*:*:*:*:*:*:*:*From (inclusive): 1.0.0
Before: 3.3.5
Vulnerable product
cpe:2.3:a:phoenixframework:phoenix_html:*:*:*:*:*:*:*:*From (inclusive): 4.0.0
Before: 4.4.0
Original applicability statements
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phoenixframework:phoenix_html:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.3.5",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phoenixframework:phoenix_html:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
]Contributing organizations · 1
Assigning organization
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.