CVE-2026-66843 in html_sanitize_ex
Summary
by MITRE • 08/06/2026
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive.
This is not unconditional cross-site scripting. A javascript: URL does not execute through <object data> in current browsers, data: documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path.
This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability described represents a critical inclusion of functionality from untrusted control sphere that exists within the HTML5 scrubber implementation of the rrrene html_sanitize_ex library. This security flaw manifests through improper sanitization of the object HTML element which serves as a URI-bearing element in the sanitized HTML processing pipeline. The vulnerability specifically affects versions of html_sanitize_ex ranging from 0.3.1 through 1.5.2, creating a window of exposure where applications relying on this library could be compromised through maliciously crafted HTML content.
The technical implementation flaw stems from the scrubber's failure to properly register the object element through the allow_tag_with_uri_attributes/3 function within lib/html_sanitize_ex/scrubber/html5.ex. This omission creates a pathway for attackers to bypass sanitization controls because the object element's only protection mechanism is a simplistic prefix match that targets lowercase "javascript:" strings in the URI scheme. This inadequate filtering approach fails to address various evasion techniques including mixed-case variants of javascript protocols, data: URIs, protocol-relative URLs, and same-origin paths that can all successfully pass through the sanitization process.
The operational impact of this vulnerability extends beyond simple cross-site scripting concerns due to its specific implementation characteristics. While it does not constitute unconditional cross-site scripting, the vulnerability creates conditions where attackers can load arbitrary documents into trusted pages through data attributes. The security implications are particularly concerning because javascript: URLs do not execute directly within object elements in modern browsers, and data: URIs load content in opaque origins that prevent direct script execution. However, the vulnerability becomes more dangerous when combined with other factors such as applications that serve attacker-controlled content from same-origin paths, potentially creating conditions for more sophisticated attacks.
This vulnerability aligns with CWE-79 which addresses cross-site scripting flaws, and demonstrates characteristics consistent with ATT&CK technique T1203 - Exploitation for Client Execution through the use of malformed HTML elements to execute arbitrary content. The flaw represents a classic case of insufficient input validation where the sanitization process fails to properly restrict URI attributes on HTML elements that should be strictly controlled. Applications using affected versions of html_sanitize_ex are particularly vulnerable because they rely on this library for HTML sanitization, creating a chain of trust issues where malicious content can bypass security controls and potentially lead to data exfiltration or further exploitation.
The recommended mitigation strategy involves upgrading to version 1.5.3 or later of html_sanitize_ex which includes proper registration of the object element through allow_tag_with_uri_attributes/3 function. Additionally, administrators should implement comprehensive input validation at multiple layers including application-level HTML sanitization and content security policy enforcement. Organizations should also consider implementing additional security measures such as restricting the use of object elements in user-generated content and monitoring for unusual data attribute usage patterns within their applications to detect potential exploitation attempts.