PatchTheCVECVE-2026-66370: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitiz
30
Routine
MEDIUM 6.1UPGRADE
CVE-2026-66370 is a medium-severity flaw (CVSS 6.1) affecting htmlsanitizeex. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction attributes on an <input> element in sanitized HTML. HTML's form attribute associates an input with any form on the page by its id even when the input si
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.1 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.4% (top 67%) |
| CISA exploited list | No |
| Weakness | CWE-601 |
| Published | 2026-08-06 |
| Last modified | 2026-10-23 |
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
rrrene htmlsanitizeex UPGRADE
Affected: >= 0.3.1 and < 1.5.3
Fixed in: 1.5.3
Safe to downgrade to: a release before 0.3.1
1. Check installed version
apt-cache policy htmlsanitizeex || rpm -q htmlsanitizeex || htmlsanitizeex --version
2. UPGRADE to 1.5.3 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade htmlsanitizeex
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade htmlsanitizeex
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 0.3.1 (Debian / Ubuntu)
apt-cache madison htmlsanitizeex
sudo apt install htmlsanitizeex=<VERSION_BEFORE_0.3.1>
sudo apt-mark hold htmlsanitizeex
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list htmlsanitizeex
sudo dnf downgrade htmlsanitizeex-<VERSION_BEFORE_0.3.1>
sudo dnf versionlock add htmlsanitizeex
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-68749 HIGH 7.5 UPGRADE Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows
- CVE-2026-68750 HIGH 7.5 UPGRADE Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an
- CVE-2026-66829 MEDIUM 6.1 UPGRADE URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitiz
- CVE-2026-66843 MEDIUM 6.1 UPGRADE Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sa
- CVE-2026-68747 MEDIUM 6.1 UPGRADE Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerabili