Phoenix.HTML attributes_escape/1 escapes attribute values but not attribute names, letting an attacker who controls attribute keys inject arbitrary attributes and scripts into rendered HTML. This improper neutralization causes a classic cross‑site scripting flaw that can compromise user confidentiality, tamper with data, and potentially execute code in the victim’s browser context.

This vulnerability impacts the Phoenix HTML library from Phoenix Framework. Affected versions include 1.0.0 up to and including 3.3.4, and 4.0.0 up to and including 4.3.9. Applications that render dynamic attributes via HEEx <tag {@attrs}>, content_tag/3, or a direct call to attributes_escape/1 are susceptible when they build attribute names from untrusted input.

The CVSS score is 5.3, indicating medium severity, and the EPSS score is not available, so current exploitation probability is unknown. The flaw is not listed in the CISA KEV catalog. Attackers can typically exploit the vulnerability remotely by supplying crafted attribute names through web requests—such as form fields or query parameters—that an application passes to attributes_escape/1 or HEEx macros. If untrusted input drives attribute name generation, an attacker can inject scripts or event handlers that execute inside the user’s browser.