The html_sanitize_ex sanitizer omits validation for the form and formaction attributes on <input> elements. An unauthenticated attacker can supply sanitized HTML that ties an existing form on the page to a malicious target by using a predictable form id and a cross‑origin absolute URL in formaction, and the attacker can obtain whatever data the victim submits, including credentials, because no scheme check is performed. This vulnerability does not execute script but permits sensitive data exfiltration through normal form submission pathways.

Vendors: rrrene's html_sanitize_ex library. Affected versions: 0.3.1 up to, but not including, 1.5.3. Pages rendering sanitized content with any of these versions are vulnerable.

The CVSS score of 4.8 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting limited exploitation demand so far. An attacker can exploit the flaw by injecting sanitized <input> tags into any content processed by the library; no authentication or elevated privileges are required. If the target page contains a form with a predictable id, the injected form association creates a backdoor that redirects the form data to the attacker’s address.