The vulnerability in html_sanitize_ex versions before 1.5.3 isn't a failure to block a dangerous element—it's a fundamental misunderstanding of how HTML scoping works. The meta tag survived sanitization because the sanitizer operates on a fragment while meta elements govern the entire document. A refresh or CSP directive in what developers treat as an isolated fragment doesn't stay contained; it escalates to document-level behavior the moment the browser parses it.
The CSP specification explicitly deprecated meta tags as CSP delivery mechanisms years before this library existed—documenting that meta elements fundamentally violate fragment isolation. This wasn't an unknown unknown. The knowledge existed in the spec, was discussed in working group meetings, and was systematically ignored by sanitizer implementors who built blocklists around script execution rather than document-scoping behavior. The same pattern appears across sanitizers: meta, base, link[rel=stylesheet], form-action—each discovered sequentially, each patched, each revealing that blocklist-based approaches cannot contain HTML's cross-boundary effects.
The CVSS 6.1 rating compounds the problem. Vulnerability management workflows trained to weight script-based findings higher will deprioritize this, yet meta refresh executes automatically on page load without any user interaction, without credential state, and without visual warning. The practical harm—forced navigation to a phishing domain—is indistinguishable from reflected XSS from a victim's perspective, but the scoring metric was built around exploit complexity, not cascade width. The 6.1 rating likely understates severity in any environment where users can be redirected silently.
The fix in 1.5.3 (stripping meta elements) is correct, but it should be understood as a point fix to a class problem. Document-scoped elements—meta, base, and potentially older HTML constructs like isindex or basefont that still parse—cannot be safely contained in sanitized fragments. If you're using any HTML sanitizer, audit whether it explicitly handles document-scoped elements as a category, not as an enumerated blocklist. The next vulnerability in this pattern isn't waiting to be discovered; it's waiting in whatever element the security community hasn't discussed at conferences yet.