The vulnerability in html_sanitize_ex (versions from 0.3.1 before 1.5.3) involves improper sanitization of the form and formaction attributes on <input> elements. HTML allows an input element to be associated with any form on the page by id, even if the input is outside the form, and the formaction attribute on a submit control overrides the form's action URL. The sanitizer does not check the URL scheme, so absolute cross-origin URLs remain intact after sanitization, enabling an attacker to redirect form submissions to untrusted external sites. This is classified as CWE-601 (Open Redirect). The CVSS 3.1 score is 6.1 (medium severity) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

An attacker can cause a victim's form submission to be redirected to an attacker-controlled external URL, potentially capturing sensitive data such as credentials submitted via the form. The vulnerability does not allow script execution or injection of new forms, so the attack depends on the presence of an existing form with an id on the page. The impact includes limited confidentiality and integrity loss due to redirection of form data to an untrusted site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using vulnerable versions of html_sanitize_ex or ensure that pages do not contain forms with predictable ids that could be abused. Consider additional input validation or sanitization on the server side to prevent untrusted URL redirection. Monitor vendor channels for official patches or updates.