The vulnerability in rrrene's html_sanitize_ex library (CVE-2026-66843) arises from insufficient sanitization of the <object> element's data attribute in the HTML5 scrubber. The <object> tag is not properly registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", which can be bypassed by mixed-case variants, data: URIs, protocol-relative URLs, and same-origin paths. This allows a remote attacker to load arbitrary documents into a trusted page context. However, current browsers prevent javascript: URLs from executing in <object data>, and data: URIs load with opaque origins, limiting the impact. Full script execution additionally requires the application to serve attacker-controlled content from a same-origin path. The affected versions are from 0.3.1 before 1.5.3.

The impact is limited due to browser security restrictions: javascript: URLs do not execute via <object data> elements, and data: URIs load with opaque origins, preventing direct script execution. Exploitation requires additional conditions such as the application serving attacker-controlled content from a same-origin path. Therefore, the vulnerability does not lead to unconditional cross-site scripting but may allow loading of attacker-chosen documents in a trusted page, potentially leading to partial trust boundary violations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is documented as of now. Users should monitor vendor communications for updates. Since the vulnerability requires specific conditions for exploitation and is of low severity, immediate urgent action is not indicated until a patch or official guidance is available.