Threats affecting pkg:hex/phoenix_html

CVE-2026-117645 is a cross-site scripting (XSS) vulnerability in the phoenix_html library of the phoenixframework. It arises from improper neutralization of input during web page generation, specifically in the handling of attribute names in HTML rendering functions. The vulnerability affects phoenix_html versions from 1.0.0 up to but not including 3.3.5, and from 4.0.0 up to but not including 4.4.0. The issue allows an attacker controlling attribute names to inject malicious attributes and scripts into rendered HTML. This occurs because attribute names are not properly escaped, enabling injection via constructs like HEEx <tag {@attrs}>, content_tag/3, or direct calls. Fixed versions are 3.3.5 and 4.4.0.