The vulnerability in rrrene's html_sanitize_ex (versions >=0.3.1 <1.5.3) involves improper sanitization of the form and formaction attributes on <input> elements. HTML allows an input element to be associated with any form on the page by id via the form attribute, and the formaction attribute on submit controls overrides the form's action URL. The sanitizer does not check the URL scheme, so an attacker can craft sanitized HTML that causes form submissions to be redirected to an untrusted external site. This is an open redirect (CWE-601) vulnerability that does not allow script execution or injection of new forms, requiring the victim page to already contain a form with an id.

An attacker can cause a victim's form submission to be redirected to an attacker-controlled external URL, potentially capturing sensitive data such as credentials submitted via the form. Since no script execution is involved, the impact is limited to redirecting form data. The vulnerability requires user interaction (UI) and an existing form on the page with an id attribute. The CVSS 4.0 base score is 4.8 (medium severity), reflecting network attack vector, low complexity, no privileges required, and partial user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when sanitizing HTML with html_sanitize_ex versions >=0.3.1 and <1.5.3, especially in contexts where untrusted input can influence form input elements. Consider additional validation or filtering of form and formaction attributes outside of the sanitizer to prevent cross-origin URLs.