PT-2022-12947 · Phoenix · Phoenix.Html

Published 2022-04-12 · Updated 2025-04-09 · CVE-2021-46871

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Phoenix Phoenix.HTML (aka phoenix html) versions prior to 3.0.4

Description The issue allows XSS in HEEx class attributes. The class attribute was not protected against XSS attacks when using HEEx.

Recommendations For versions prior to 3.0.4, update to version 3.0.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the class attribute in HEEx templates to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-46871

GHSA-5G2H-9X5V-5H3X

GHSA-J3GG-R6GP-95Q2

Affected Products

Phoenix.Html

References · 9

• https://github.com/phoenixframework/phoenix_html/commit/62a0139fb716bcdce697f6221244bd81d321d620 · Patch
• https://osv.dev/vulnerability/GHSA-5g2h-9x5v-5h3x · Vendor Advisory
• https://github.com/advisories/GHSA-j3gg-r6gp-95q2 · Patch
• https://osv.dev/vulnerability/CVE-2021-46871 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46871 · Security Note
• https://osv.dev/vulnerability/GHSA-j3gg-r6gp-95q2 · Vendor Advisory
• https://github.com/phoenixframework/phoenix_html · Note
• https://t.me/cvenotify/118495 · Telegram Post
• https://t.me/cvenotify/41681 · Telegram Post