phoenix_html vulnerabilities

CVEs whose affected-version data names the phoenix_html package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-117645Medium· 5.3

1w ago

Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Ph…

▾ Sunlitphoenixframework · phoenix_htmlEPSS 0.32%via CVEORG