CyberRota Analysis
AI-GeneratedThe vulnerability arises from improper input handling in the Doggo library, specifically affecting the rendering of date fields in Phoenix forms, which allows for reflected cross-site scripting (XSS) attacks. Attackers can exploit this flaw to inject malicious scripts into web applications that utilize user-controlled parameters, particularly those using the `<.field type="date">` component. Organizations using affected versions of Doggo (from 0.1.0 to before 0.14.8) should prioritize remediation to mitigate potential XSS risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woylie doggo allows Reflected XSS. Doggo.normalize_value/2 in lib/doggo.ex returned date field values wrapped in {:safe, ...}, the Phoenix.HTML marker meaning "already escaped, emit verbatim", without escaping them, so the value reached the value attribute of the <input> rendered by the field component unchanged. Any application rendering <.field type="date"> over user-controlled params is affected through the ordinary Phoenix form round-trip, where a failed validation re-renders the submitted value. The pattern kept exactly the first ten bytes and discarded shorter values, capping a payload at ten bytes: enough to terminate the attribute and open an element or attach a short event handler, not enough to place attacker-chosen script inline. Only type="date" is affected. This issue affects doggo: from 0.1.0 before 0.14.8.