Vulnerability GHSA-5g2h-9x5v-5h3x
Medium Risk
MEDIUM RISK
CVSS Score: 6.1
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
3 years ago
January 10, 2023 at 06:30 AM UTC
phoenix_html allows Cross-site Scripting in HEEx class attributes
2.10.4 - 3.0.3
2.10.4 - 3.0.3
Summary
phoenix_html allows Cross-site Scripting in HEEx class attributes
Details
tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
8 hours ago
Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
1.0.0 - 3.3.4 and 4.0.0 - 4.3.0 EEF-CVE-2026-117645
1.0.0 - 3.3.4 and 4.0.0 - 4.3.0 EEF-CVE-2026-117645
Medium Risk
4 years ago
XSS in HEEx class attributes
1.0.0 - 3.0.3 GHSA-j3gg-r6gp-95q2
1.0.0 - 3.0.3 GHSA-j3gg-r6gp-95q2
Impacted packages
Timeline
Published
3 years ago
January 10, 2023 at 06:30 AM UTC
Fixed (3.0.4)
5 years ago
September 23, 2021 at 07:28 AM UTC
Fixed (3.0.4)
5 years ago
September 23, 2021 at 07:28 AM UTC
Last Modified
1 month ago
September 10, 2026 at 03:49 AM UTC