CVE-2026-66353: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in woylie doggo

The vulnerability in woylie doggo occurs in the Doggo.normalize_value/2 function, which returns date field values wrapped in the Phoenix.HTML {:safe, ...} marker indicating the content is already escaped. However, the values are not actually escaped, allowing user input to be rendered verbatim in the value attribute of <input type="date"> fields. This enables reflected XSS through the ordinary Phoenix form round-trip mechanism when validation fails and the submitted value is re-rendered. The payload is limited to ten bytes, enough to close the attribute and inject a short event handler or element, but not enough for inline script injection. Only the date input type is affected. The issue affects doggo versions from 0.1.0 before 0.14.8.

An attacker can exploit this vulnerability to perform reflected cross-site scripting attacks by injecting malicious HTML or event handlers into date input fields rendered by the doggo library. This could lead to execution of attacker-controlled code in the context of the victim's browser when they interact with affected forms. The impact is limited by the payload size restriction and the fact that only type="date" inputs are affected. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, and low impact on confidentiality and integrity.

No official fix or patch is currently documented for this vulnerability. Users of doggo should upgrade to version 0.14.8 or later once available, as versions before 0.14.8 are affected. Until a fix is released, avoid rendering <.field type="date"> components over user-controlled parameters that might fail validation and be re-rendered. Review and sanitize user input before rendering in date fields to prevent injection. Monitor vendor advisories for updates and official patches.