CVE-2021-46871: phoenix_html allows Cross-site Scripting in HEEx class attributes

January 10, 2023 (updated April 9, 2025)

tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes

References

github.com/advisories/GHSA-5g2h-9x5v-5h3x
github.com/advisories/GHSA-j3gg-r6gp-95q2
github.com/phoenixframework/phoenix_html
github.com/phoenixframework/phoenix_html/commit/62a0139fb716bcdce697f6221244bd81d321d620
nvd.nist.gov/vuln/detail/CVE-2021-46871

Code Behaviors & Features

Detect and mitigate CVE-2021-46871 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →