Is CVE-2026-66370 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66370 being exploited in the wild.

How severe is CVE-2026-66370?

Medium severity, with a CVSS score of 6.1, published 6 August 2026.

Which products and versions are affected?

Rrrene Html Sanitize Ex 0.3.1 before 1.4.5, 1.5.0-rc.0 before 1.5.3.

Is there a fix for CVE-2026-66370?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-66370 attacked?

It is attacked over the network.

Am I affected by CVE-2026-66370?

Check whether you run Rrrene Html Sanitize Ex or Rrrene Htmlsanitizeex at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66370: rrrene html_sanitize_ex open redirect via form attributes

CVE-2026-66370 · Severity: medium · CVSS 6.1 · Published 2026-08-06

html_sanitize_ex is a library that removes potentially malicious HTML code from user input. An attacker can craft HTML containing form and formaction attributes that cause a legitimate form already on a web page to submit to a malicious site, potentially capturing user credentials and other sensitive data. The vulnerability affects multiple versions and does not require script execution or the attacker to add their own form.

Technologies: Rrrene Html Sanitize Ex, Rrrene Htmlsanitizeex. Vendors: Rrrene.

Quick answers

Is CVE-2026-66370 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66370 being exploited in the wild.
How severe is CVE-2026-66370?: Medium severity, with a CVSS score of 6.1, published 6 August 2026.
Which products and versions are affected?: Rrrene Html Sanitize Ex 0.3.1 before 1.4.5, 1.5.0-rc.0 before 1.5.3.
Is there a fix for CVE-2026-66370?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-66370 attacked?: It is attacked over the network.
Am I affected by CVE-2026-66370?: Check whether you run Rrrene Html Sanitize Ex or Rrrene Htmlsanitizeex at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an open redirect / form hijacking issue in the HTML5 scrubber component of html_sanitize_ex. The root cause is that the sanitizer fails to validate or strip the form and formaction attributes on input and submit elements. An attacker can use the form attribute to associate an input with any form on the page by its id, and the formaction attribute to override the target URL of a submit button, redirecting to a cross-origin URL. The attack requires a pre-existing form with an id on the rendering page but does not require authentication or script execution. Affected versions are 0.3.1 before 1.4.5 and 1.5.0-rc.0 before 1.5.3. Patches are available in versions 1.4.5 and 1.5.3 or later.

Affected products

rrrene html_sanitize_ex 0.3.1 before 1.4.5, 1.5.0-rc.0 before 1.5.3

Timeline

2026-08-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.