GitHub Advisoryadvisory · Hex

GHSA-j3gg-r6gp-95q2 XSS in HEEx class attributes

MEDIUM Published 2022-04-12 Modified 2022-04-12 Official page ↗

Ecosystem: Hex
Packages: phoenix_html
Severity: Moderate
Weaknesses: CWE-79
Reviewed: 2022-04-12

Affected packages

• Hex phoenix_html: < 3.0.4 → fixed in 3.0.4

Description

The `class` attribute was not protected against XSS attacks when using HEEx.

Related

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References