phoenix_html allows Cross-site Scripting in HEEx class attributes
Date: 2023-01
Affected: erlang/phoenix_html, npm/phoenix_html
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2021-46871
CWE: CWE-79
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes


Mitigations:

Architectural layers (MAESTRO):