Riskcovery

CVE-2026-66843

html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding

State
Published
Severity
2.3 Low
Published
Aug 6, 2026
Updated
Aug 19, 2026
Reserved
Aug 6, 2026

Read the record on cve.org

Description

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive.

This is not unconditional cross-site scripting. A javascript: URL does not execute through <object data> in current browsers, data: documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path.

This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.

Scores

CVSSScoreVectorSource
4.02.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NEEF

Weaknesses

  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere

Affected Products

ProductVersions
html_sanitize_exrrrene
  • 0.3.1 to before 1.4.5Affected
  • 1.5.0-rc.0 to before 1.5.3Affected
html_sanitize_exrrrene
  • 8976d64ea0b77d26093a94a43ec48a3978e8d028 and laterAffectedfrom bec27fec4de99e40c68c4285a610e09e791a3eafNot affectedfrom ce038aa1af5a960d50f8eb5d368cc57bb2b9a9f0Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.