Is CVE-2026-66829 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66829 being exploited in the wild.

How severe is CVE-2026-66829?

Medium severity, with a CVSS score of 6.1, published 6 August 2026.

Which products and versions are affected?

Rrrene Html Sanitize Ex 0.3.1 to 1.4.4, 1.5.0-rc.0 to 1.5.2.

Is there a fix for CVE-2026-66829?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-66829 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-66829?

Check whether you run Rrrene Html Sanitize Ex or Rrrene Htmlsanitizeex at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66829: rrrene html_sanitize_ex open redirect in meta refresh

CVE-2026-66829 · Severity: medium · CVSS 6.1 · Published 2026-08-06

html_sanitize_ex is a library used to clean potentially malicious HTML content from user input. A vulnerability in its HTML5 scrubber allows attackers to inject meta refresh tags that redirect visitors to attacker-controlled websites, or inject meta directives like Content-Security-Policy headers. An attacker could trick users into visiting phishing sites or compromise website security policies through sanitized content.

Technologies: Rrrene Html Sanitize Ex, Rrrene Htmlsanitizeex. Vendors: Rrrene.

Quick answers

Is CVE-2026-66829 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66829 being exploited in the wild.
How severe is CVE-2026-66829?: Medium severity, with a CVSS score of 6.1, published 6 August 2026.
Which products and versions are affected?: Rrrene Html Sanitize Ex 0.3.1 to 1.4.4, 1.5.0-rc.0 to 1.5.2.
Is there a fix for CVE-2026-66829?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-66829 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-66829?: Check whether you run Rrrene Html Sanitize Ex or Rrrene Htmlsanitizeex at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The HTML5 scrubber in html_sanitize_ex fails to remove or neutralize meta elements (specifically <meta http-equiv="refresh">) from sanitized output. Meta elements operate at the document level rather than fragment level, allowing injected meta tags to affect the entire page, including potential redirection or content security policy injection. The vulnerability requires no authentication and is exploitable via any content that passes through the library's sanitization function. An attacker can craft HTML containing a meta refresh element pointing to an arbitrary URL to achieve open redirect, or inject document-wide directives. The vulnerability affects versions 0.3.1 through 1.4.4 and 1.5.0-rc.0 through 1.5.2; patches are available in versions 1.4.5 and 1.5.3 or later.

Affected products

rrrene html_sanitize_ex 0.3.1 to 1.4.4, 1.5.0-rc.0 to 1.5.2

Timeline

2026-08-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.