A meta element supplied by an attacker and passed through the HTML5 scrubber in html_sanitize_ex remains in the sanitized output, enabling an attacker to force a user’s browser to navigate to an untrusted site via a <meta http-equiv="refresh"> tag. Because the meta directive applies to the entire document rather than just the fragment, it can also declare global directives such as Content‑Security‑Policy, potentially weakening security constraints for the visitor. The vulnerability does not allow script execution; browsers do not process a meta refresh targeting a javascript: URL, so the weakness is limited to open redirect and policy manipulation. This is categorized as CWE‑601, an Open Redirect flaw.

The vulnerability affects the rrrene html_sanitize_ex library, specifically versions from 0.3.1 up through but excluding 1.5.3. Systems that incorporate this library to sanitize user‑supplied HTML for display in a browser are at risk if the HTML sanitizer is used without filtering out meta tags.

The CVSS score of 2.3 indicates low severity, and no exploit probability score is available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a server that accepts untrusted HTML input, passes it through html_sanitize_ex, and renders the sanitized output in a browser. An attacker can embed a meta refresh tag in the input to coerce any user who views the page to be redirected to an arbitrary site. While the risk of exploitation is considered low, it still permits a user‑targeted redirection that can be socially engineered for phishing or traffic manipulation.