{"action":"Upgrade phoenix_html to 3.0.4 or later.","affected":[{"fixed":"3.0.4","introduced":"0"}],"component":"phoenix_html","cve_ids":["CVE-2021-46871"],"ecosystem":"npm","epss":0.00434,"exploited":false,"fixed_versions":["3.0.4"],"ghsa_id":"GHSA-5g2h-9x5v-5h3x","id":"tcs_01M5KF3M5PVKSXR2TZVXW5XG6W","modified_at":"2026-09-10T03:49:56.603676080Z","published_at":"2023-01-10T06:30:25Z","references":["https://osv.dev/vulnerability/GHSA-5g2h-9x5v-5h3x","https://nvd.nist.gov/vuln/detail/CVE-2021-46871","https://github.com/phoenixframework/phoenix_html/commit/62a0139fb716bcdce697f6221244bd81d321d620","https://github.com/advisories/GHSA-j3gg-r6gp-95q2","https://github.com/phoenixframework/phoenix_html"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-5g2h-9x5v-5h3x","url":"https://osv.dev/vulnerability/GHSA-5g2h-9x5v-5h3x"}],"summary":"phoenix_html allows Cross-site Scripting in HEEx class attributes"}