The vulnerability in rrrene's html_sanitize_ex library arises from insufficient sanitization of the <object> element's data attribute in HTML5 scrubber functionality. The <object> element is not properly registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", which can be bypassed by mixed-case variants, data: URIs, protocol-relative URLs, and same-origin paths. This allows an attacker to load a document of their choosing into a trusted page. Despite this, exploitation is limited because javascript: URLs do not execute in <object data> in modern browsers, data: URIs load in an opaque origin, and executing host-origin scripts requires the application to serve attacker-controlled content from a same-origin path.

An attacker can cause a trusted page to load arbitrary documents via the <object> element's data attribute in sanitized HTML. This could potentially lead to content injection or information disclosure under specific conditions. However, the vulnerability does not enable unconditional cross-site scripting or direct script execution due to browser security models and origin restrictions. The overall impact is limited and rated as low severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider avoiding use of affected versions or apply additional sanitization or filtering controls on <object> elements and their data attributes. Monitor vendor channels for updates and patches addressing this issue.