CVE-2026-66843

Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.2

Description An Inclusion of Functionality from Untrusted Control Sphere issue exists in the HTML5 scrubber. A remote attacker can load an arbitrary document into a trusted page by utilizing the data attribute of an <object> element within sanitized HTML. This occurs because the <object> element in lib/html sanitize ex/scrubber/html5.ex was not registered through allow tag with uri attributes/3 and only employs a lowercase prefix match for "javascript:". Consequently, data URIs, protocol-relative URLs, same-origin paths, and mixed-case variants are not properly filtered. While this does not lead to unconditional cross-site scripting, host-origin script execution is possible if the application serves attacker-controlled content from a same-origin path.

Recommendations Update to version 1.5.3. As a temporary workaround, sanitize input using basic html/1, markdown html/1, or strip tags/1, or define a custom scrubber that omits the <object> element. Implement a Content-Security-Policy with object-src 'none' to block the loading of injected <object> elements. Host user uploads on a separate origin to remove the escalation path for script execution.