The html_sanitize_ex library's HTML5 scrubber improperly retains attacker-supplied <meta http-equiv="refresh"> elements in sanitized output, enabling an open redirect vulnerability (CWE-601). This allows an attacker to force visitors of a page to navigate to a site of the attacker's choosing. The vulnerability affects versions from 0.3.1 before 1.5.3. It does not allow script execution via javascript: URLs due to browser restrictions. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

An attacker can cause users to be redirected to arbitrary external sites by injecting a <meta http-equiv="refresh"> element into sanitized HTML output. This can be used for phishing or redirecting users to malicious sites. However, it does not allow cross-site scripting or direct code execution. The impact is limited to user redirection and potential loss of trust or exposure to malicious content on the redirected site.

No official patch or fix is currently documented. Users should upgrade to html_sanitize_ex version 1.5.3 or later once available, as the vulnerability affects versions before 1.5.3. Until then, avoid using vulnerable versions or implement additional filtering to remove or sanitize <meta http-equiv="refresh"> elements. Monitor vendor advisories for official remediation updates. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.