The vulnerability in rrrene's html_sanitize_ex library (versions >=0.3.1 <1.5.3) involves improper sanitization of <meta http-equiv="refresh"> elements in HTML5 content. The sanitizer retains attacker-supplied meta refresh tags, which act on the entire document and can redirect users to arbitrary URLs. This open redirect vulnerability (CWE-601) does not enable script execution because browsers block javascript: URLs in meta refresh. The flaw allows remote attackers to force navigation to untrusted sites via sanitized HTML content.

An attacker can cause users visiting a page that uses the vulnerable html_sanitize_ex library to be redirected to a site of the attacker's choosing. This could be used for phishing or redirecting users to malicious sites. However, the vulnerability does not allow script execution or compromise the original site directly. The overall impact is limited, reflected by a low CVSS score of 2.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor vendor communications for updates. Until a fix is available, avoid using vulnerable versions (>=0.3.1 <1.5.3) or sanitize input to remove meta refresh elements manually.