HTML Sanitize Ex Object URI Handling Flaw

Executive Summary

CVE-2026-66843 is an Inclusion of Functionality from Untrusted Control Sphere vulnerability in the html_sanitize_ex library. It affects versions from 0.3.1 before 1.5.3. The issue involves improper handling of the <object> HTML element, which can carry URIs. The sanitizer fails to properly restrict the data attribute of <object> elements, allowing attackers to embed untrusted content. Checks for javascript: prefixes are bypassed by mixed-case variants, data URIs, protocol-relative URLs, and same-origin paths.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect applications using html_sanitize_ex versions 0.3.1 to 1.5.2 for improperly sanitized <object> tags with data attributes. Check for mixed-case 'javascript:' variants, data URIs, or protocol-relative URLs in sanitized HTML output.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitized HTML. While it does not directly enable cross-site scripting in modern browsers, it may lead to unintended content loading or escalation if the application serves attacker-controlled content from a same-origin path. The impact is limited but could result in data leaks or phishing attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unintended data loading through untrusted sources. If exploited, it may lead to unauthorized data exposure or processing, violating data protection requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade html_sanitize_ex to version 1.5.3 or later to apply the patch for <object> tag sanitization.
• Replace html_sanitize_ex sanitization with safer alternatives like basic_html/1, markdown_html/1, or strip_tags/1.
• Implement a custom scrubber that explicitly excludes <object> tags from allowed HTML.
• Enforce a Content-Security-Policy header with object-src 'none' to block <object> tag execution.

Useful 0 Not Useful 0