EEF-CVE-2026-66370

## Summary

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the `form` and `formaction` attributes on an `<input>` element in sanitized HTML. HTML's `form` attribute associates an input with any form on the page by its `id` even when the input sits outside that form, and `formaction` on a submit control overrides the owning form's `action`. Neither attribute receives a scheme check, so an absolute cross-origin URL survives sanitizing.

No script executes. The scrubber allows neither `form` nor `button`, so the attacker cannot introduce a form of their own and the rendering page must already contain a form carrying an `id`.

This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.

## Workarounds

Sanitize with `basic_html/1`, `markdown_html/1` or `strip_tags/1`, none of which allow `input`, or define a custom scrubber that omits it.

Omitting the `id` attribute from the page's own forms, or giving them values an attacker cannot predict, removes the anchor the injected `form` attribute needs.

## Configurations

Only `HtmlSanitizeEx.html5/1`, and custom scrubbers declared with `use HtmlSanitizeEx, extend: :html5`, allow the `input` element, and the sanitized output must be rendered to other users.

The rendering page must also contain a form with an `id`, since that `id` is what the injected `form` attribute binds to.