CVE-2026-66353: Doggo Cross-Site Scripting Vulnerability via Unescaped Date Field Values
Summary
CVE-2026-66353: Doggo vulnerable to cross-site scripting via unescaped date field values. Affects doggo across 2 version ranges.
>= 0.1.0, < 0.14.8
>= ae65fed72982ec97f95af931686c627b19c2b58d, < 0161c976a114a4a4faee22d599b3fd5f147fc443
Fixed in 0.14.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Doggo is an open-source library developed by Woylie, primarily used for handling form inputs in web applications. It provides a set of components that facilitate the rendering of HTML forms, ensuring that user inputs are processed correctly. However, an identified vulnerability allows for cross-site scripting (XSS) attacks, particularly through the handling of date fields, which can lead to security risks if user-controlled parameters are not properly sanitized.
Vulnerability Detail
The vulnerability arises from improper neutralization of input during web page generation, specifically in the Doggo library's handling of date field values. The function Doggo.normalize_value/2 returns date values wrapped in a safe marker without escaping them, allowing untrusted input to be rendered directly in the HTML. This can lead to reflected XSS attacks, where an attacker can manipulate the input to execute malicious scripts in the context of the user's browser. The vulnerability affects versions of Doggo from 0.1.0 to before 0.14.8, and it is particularly concerning for applications that render form fields based on user input.
How To Fix
Minimum fixed version
0.14.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, you can implement one of the following workarounds: 1. Change the input type from 'date' to 'text' for fields that may receive user-submitted parameters. This will ensure that the input is treated as a plain string and properly escaped. Example: <.field type="text">. 2. Alternatively, pass a validated ISO 8601 date directly to the component instead of allowing it to read from the form field, ensuring that no malicious input is processed.
Conclusion
The CVE-2026-66353 vulnerability in the Doggo library poses a significant risk due to improper handling of user input in date fields, leading to potential XSS attacks. It is crucial for developers using this library to update to the latest version or implement workarounds to safeguard their applications.
See every vulnerability recorded for doggo →
FAQ
CVE-2026-66353 is a vulnerability in the Doggo library that allows for cross-site scripting (XSS) attacks through unescaped date field values.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
The vulnerability affects Doggo versions from 0.1.0 to before 0.14.8.
You should update the Doggo package to version 0.14.8 or later. If immediate updates are not possible, consider using workarounds such as changing input types or validating inputs.
The CVSS score for this vulnerability is 5.3, indicating a moderate level of risk.
