The vulnerability in rrrene's html_sanitize_ex (CVE-2026-66370) involves improper sanitization of the form and formaction attributes on <input> elements. Because HTML allows input elements to be associated with forms by id even if outside the form, and formaction can override the form's action URL, an attacker can craft sanitized HTML that retargets an existing form's submission to an arbitrary external URL. The sanitizer does not check the URL scheme, so absolute cross-origin URLs survive. The attacker cannot add new forms or buttons, so the attack requires the presence of a form with an id on the rendering page. This vulnerability affects versions >=0.3.1 and <1.5.3, including 1.5.0-rc.0. The CVSS 3.1 base score is 4.8 (medium severity).

An attacker can cause a victim's form submission to be redirected to an attacker-controlled site, potentially capturing sensitive data such as credentials submitted via the form. Since no script execution is involved, the impact is limited to redirecting form data. The vulnerability requires that the target page already contains a form with an id attribute. There are no known exploits in the wild.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using vulnerable versions of html_sanitize_ex or ensure that the rendering pages do not contain forms with id attributes that could be retargeted. Monitor vendor channels for updates and apply official fixes once released.