Executive brief
Woylie Doggo is a Phoenix component library for building web application forms. A reflected XSS vulnerability in the date field component allows attackers to inject malicious scripts through user-controlled input that fails validation. Attackers can exploit this to steal session cookies, redirect users to phishing sites, or perform actions on behalf of logged-in users.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in the Doggo.normalize_value/2 function in lib/doggo.ex. The function returns date field values wrapped in the {:safe, ...} Phoenix.HTML marker (indicating "already escaped, emit verbatim") without actually escaping them, allowing unescaped user input to reach the value attribute of the rendered <input> element. The attack vector is through ordinary Phoenix form round-trips where validation fails and the submitted value is re-rendered. The payload is limited to ten bytes (the length of the date string format), sufficient to terminate an attribute or attach a short event handler but not to inject arbitrary inline scripts. Only the date field type is affected. Applications using <.field type="date"> with user-controlled params are vulnerable. Patched versions are available (0.14.8 and later).
Affected products
- Woylie Doggo 0.1.0 to before 0.14.8
Timeline
- 2026-08-27: disclosed