Threats tagged 'ghsa-jwcv-27cf-c7j5'

A Cross-site Scripting (XSS) vulnerability exists in phoenix_html, a component of the Phoenix Framework, due to improper neutralization of input during web page generation. The vulnerability arises because attribute names are not properly escaped, allowing an attacker controlling attribute names to inject malicious attributes and scripts into rendered HTML. This affects phoenix_html versions from 1.0.0 before 3.3.5 and from 4.0.0 before 4.4.0. The issue occurs when untrusted input is used to build attribute keys rendered through HEEx <tag {@attrs}>, content_tag/3, or direct calls. The vulnerability has a medium severity with a CVSS score of 5.3. No known exploits in the wild or patch information is provided.