The HTML5 scrubber in html_sanitize_ex incorrectly permits the form and formaction attributes on <input> elements, allowing an unauthenticated attacker to redirect an existing form on the page to an arbitrary cross‑origin URL via sanitized HTML. Because neither attribute is checked for a valid scheme, the redirected form submits any entered data, including credentials, to the attacker's endpoint. No script execution occurs, and the sanitizer blocks the creation of its own form or button elements, so the attacker must rely on hijacking a form that already exists on the page.

Vendors: rrrene's html_sanitize_ex library. Affected versions: 0.3.1 up to, but not including, 1.4.5, and 1.5.0-rc.0 up to, but not including, 1.5.3. Pages rendering sanitized content with any of these versions are vulnerable.

The CVSS score of 4.8 indicates moderate severity. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. An attacker can exploit the flaw by injecting sanitized <input> elements into content processed by the library; no authentication or elevated privileges are required. If the target page contains a form with a predictable id, the injected form association creates a backdoor that redirects the form data to the attacker’s address.