CVE-2026-66829: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') in rrrene html_sanitize_ex
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a <meta http-equiv="refresh"> element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied <meta> elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy. This is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.
AI Analysis
Technical Summary
The vulnerability exists in the html_sanitize_ex library's html5 scrubber where attacker-supplied <meta http-equiv="refresh"> elements are not removed during sanitization. Because a meta refresh applies to the entire document, this can be used to redirect users to arbitrary external sites. The affected versions are from 0.3.1 before 1.5.3. This is classified as CWE-601 (URL Redirection to Untrusted Site). The issue does not enable script execution since browsers block javascript: URLs in meta refresh, so it is not a cross-site scripting vulnerability.
Potential Impact
An attacker can craft sanitized HTML that causes users to be redirected to attacker-controlled websites, potentially facilitating phishing or other social engineering attacks. However, no code execution or direct compromise of the affected system occurs. The impact is limited to user redirection.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor vendor communications for updates. Until a fix is available, avoid using vulnerable versions or sanitize HTML with alternative methods that remove meta refresh elements.
CVE-2026-66829: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') in rrrene html_sanitize_ex
Description
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a <meta http-equiv="refresh"> element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied <meta> elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy. This is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.
CVSS v4.0
Score 2.3low
Affected software
rrrene
html_sanitize_ex
rrrene
html_sanitize_ex
pkg:hex/html_sanitize_excpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the html_sanitize_ex library's html5 scrubber where attacker-supplied <meta http-equiv="refresh"> elements are not removed during sanitization. Because a meta refresh applies to the entire document, this can be used to redirect users to arbitrary external sites. The affected versions are from 0.3.1 before 1.5.3. This is classified as CWE-601 (URL Redirection to Untrusted Site). The issue does not enable script execution since browsers block javascript: URLs in meta refresh, so it is not a cross-site scripting vulnerability.
Potential Impact
An attacker can craft sanitized HTML that causes users to be redirected to attacker-controlled websites, potentially facilitating phishing or other social engineering attacks. However, no code execution or direct compromise of the affected system occurs. The impact is limited to user redirection.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor vendor communications for updates. Until a fix is available, avoid using vulnerable versions or sanitize HTML with alternative methods that remove meta refresh elements.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- EEF
- Date Reserved
- 2026-08-06T08:15:02.719Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a74ab41bf8831d539ec74df
Added to database: 08/06/2026, 15:41:53 UTC
Last enriched: 08/13/2026, 17:14:42 UTC
Last updated: 09/17/2026, 22:01:37 UTC
Views: 48
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.