CVE-2026-66843

Analyzed Analyzed - Analysis Complete

HTML Sanitize Ex Object URI Handling Flaw

Publication date: 2026-08-06

Last updated on: 2026-08-11

Assigner: EEF

Description

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive. This is not unconditional cross-site scripting. A javascript: URL does not execute through <object data> in current browsers, data: documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path. This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-11

Generated

2026-08-16

AI Q&A

2026-08-06

EPSS Evaluated

2026-08-15

NVD

CVE-2026-66843

EUVD

EUVD-2026-54080

Affected Vendors & Products

Vendor	Product	Version / Range
rrrene	htmlsanitizeex	From 0.3.1 (inc) to 1.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

CVE-2026-66843 is an Inclusion of Functionality from Untrusted Control Sphere vulnerability in the html_sanitize_ex library. It affects versions from 0.3.1 before 1.5.3. The issue involves improper handling of the <object> HTML element, which can carry URIs. The sanitizer fails to properly restrict the data attribute of <object> elements, allowing attackers to embed untrusted content. Checks for javascript: prefixes are bypassed by mixed-case variants, data URIs, protocol-relative URLs, and same-origin paths.

Detection Guidance

To detect this vulnerability, inspect applications using html_sanitize_ex versions 0.3.1 to 1.5.2 for improperly sanitized <object> tags with data attributes. Check for mixed-case 'javascript:' variants, data URIs, or protocol-relative URLs in sanitized HTML output.

Impact Analysis

This vulnerability could allow a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitized HTML. While it does not directly enable cross-site scripting in modern browsers, it may lead to unintended content loading or escalation if the application serves attacker-controlled content from a same-origin path. The impact is limited but could result in data leaks or phishing attacks.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unintended data loading through untrusted sources. If exploited, it may lead to unauthorized data exposure or processing, violating data protection requirements under these regulations.

Mitigation Strategies

Upgrade html_sanitize_ex to version 1.5.3 or later to apply the patch for <object> tag sanitization.
Replace html_sanitize_ex sanitization with safer alternatives like basic_html/1, markdown_html/1, or strip_tags/1.
Implement a custom scrubber that explicitly excludes <object> tags from allowed HTML.
Enforce a Content-Security-Policy header with object-src 'none' to block <object> tag execution.

Hi! I’m here to help you understand CVE-2026-66843. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70