Reflected XSS via unescaped date field values

Reflected XSS in woylie Doggo 0.1.0 through 0.14.7 allows remote attackers to inject HTML through crafted date field values. Doggo.normalize_value/2 in lib/doggo.ex marks the first ten bytes of a date value as already safe, so Phoenix emits them unescaped into an input value attribute. Exploitation requires an application to render a date field from user-controlled parameters after failed validation and a victim to load the reflected response; the ten-byte limit permits attribute termination and short markup or event handlers but not attacker-chosen inline script.