Medium · 6.1 CVE-2021-46871 EUVD-2023-0339GHSA-5g2h-9x5v-5h3xGHSA-j3gg-r6gp-95q2

phoenix_html allows Cross-site Scripting in HEEx class attributes

Published Jan 10, 2023 · Updated Apr 9, 2025 · Assigned by mitre

Description

tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes.

Ecosystem	Package	Affected	Fixed	Record
Hex	phoenix_html	< 3.0.4	3.0.4	GHSA-5g2h-9x5v-5h3x
npm	phoenix_html	< 3.0.4	3.0.4	GHSA-5g2h-9x5v-5h3x