The vulnerability in rrrene's html_sanitize_ex (versions >=0.3.1 <1.5.3) involves improper sanitization of the form and formaction attributes in HTML input elements. The sanitizer fails to check the URL scheme, allowing an attacker to specify an absolute cross-origin URL in these attributes. Since HTML allows an input element to be associated with any form on the page by its id, an attacker can retarget an existing form's submission to a malicious external site. This can lead to the victim unknowingly submitting sensitive information, such as credentials, to the attacker. The vulnerability does not enable script execution, and the attacker cannot add new form or button elements, limiting the attack to retargeting existing forms only.

An attacker can cause a victim to submit form data, including potentially sensitive information like credentials, to an attacker-controlled external site by exploiting the open redirect in sanitized HTML. This can lead to information disclosure. However, no script execution or direct code injection is possible. The attack requires the presence of a form with an id on the rendering page and user interaction to submit the form.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor vendor communications for updates. Until a fix is available, avoid using vulnerable versions (>=0.3.1 <1.5.3) of html_sanitize_ex or implement additional validation to restrict form and formaction attributes to trusted URLs. Consider restricting or sanitizing input that can influence these attributes to prevent cross-origin redirection.