~ / search / GHSA-5g2h-9x5v-5h3x

GHSA-5g2h-9x5v-5h3x

phoenix_html allows Cross-site Scripting in HEEx class attributes

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-46871

Packages

EcosystemPackageAffectedFixed in
npm phoenix_html < 3.0.4 3.0.4
Hex phoenix_html < 3.0.4 3.0.4

Details

As written in the advisory (Markdown source, shown as plain text).

tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes

References

External links from the advisory. They lead to third-party sites.