https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 04:18:26 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-66353 <p>Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;) vulnerability in woylie doggo allows Reflected XSS.</p> <p>Doggo.normalize_value/2 in lib/doggo.ex returned date field values wrapped in {:safe, ...}, the Phoenix.HTML marker meaning &#34;already escaped, emit verbatim&#34;, without escaping them, so the value reached the value attribute of the &lt;input&gt; rendered by the field component unchanged. Any application rendering &lt;.field type=&#34;date&#34;&gt; over user-controlled params is affected through the ordinary Phoenix form round-trip, where a failed validation re-renders the submitted value. The pattern kept exactly the first ten bytes and discarded shorter values, capping a payload at ten bytes: enough to terminate the attribute and open an element or attach a short event handler, not enough to place attacker-chosen script inline. Only type=&#34;date&#34; is affected.</p> <p>This issue affects doggo: from 0.1.0 before 0.14.8.</p> <p>Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;) vulnerability in woylie doggo allows Reflected XSS.</p> <p>Doggo.normalize_value/2 in lib/doggo.ex returned date field values wrapped in {:safe, ...}, the Phoenix.HTML marker meaning &#34;already escaped, emit verbatim&#34;, without escaping them, so the value reached the value attribute of the &lt;input&gt; rendered by the field component unchanged. Any application rendering &lt;.field type=&#34;date&#34;&gt; over user-controlled params is affected through the ordinary Phoenix form round-trip, where a failed validation re-renders the submitted value. The pattern kept exactly the first ten bytes and discarded shorter values, capping a payload at ten bytes: enough to terminate the attribute and open an element or attach a short event handler, not enough to place attacker-chosen script inline. Only type=&#34;date&#34; is affected.</p> <p>This issue affects doggo: from 0.1.0 before 0.14.8.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-66353