Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to… (CVE-2026-66843)
CVE-2026-66843 is a vulnerability in the HTML5 scrubber of the html_sanitize_ex library that allows a remote attacker to load arbitrary documents into a trusted page via the data attribute of an <object> element in sanitized HTML. The vulnerability arises because the <object> element is not properly registered or guarded against certain URI schemes, allowing mixed-case javascript:, data: URIs, protocol-relative URLs, and same-origin paths to bypass filtering. However, this does not result in unconditional cross-site scripting due to browser restrictions on javascript: URLs in <object data> and the opaque origin of data: documents. Exploitation requires the application to serve attacker-controlled content from a same-origin path. This issue affects html_sanitize_ex versions from 0.3.1 up to but not including 1.5.3.
AI Analysis
Technical Summary
The vulnerability in html_sanitize_ex's HTML5 scrubber involves improper handling of the <object> element's data attribute, which is the only URI-bearing element not properly registered through allow_tag_with_uri_attributes/3. Its only guard is a prefix match on lowercase "javascript:", which allows bypasses via mixed-case javascript:, data: URIs, protocol-relative URLs, and same-origin paths. This enables a remote attacker to load a document of their choosing into a trusted page. While this does not lead to unconditional cross-site scripting due to browser protections and origin policies, it can lead to limited impact if the attacker can serve content from a same-origin path. The affected versions are html_sanitize_ex from 0.3.1 before 1.5.3. The CVSS v3.1 score is 6.1 (medium severity) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Potential Impact
The vulnerability allows an attacker to load arbitrary documents into a trusted page via the <object> element's data attribute in sanitized HTML. This can lead to limited confidentiality and integrity impacts due to the ability to load attacker-controlled content in the context of the trusted page. However, it does not enable unconditional cross-site scripting because javascript: URLs do not execute in <object data> in current browsers, data: URIs load in an opaque origin, and script execution requires the application to serve attacker-controlled content from a same-origin path. There is no impact on availability. Overall, the impact is limited but can affect confidentiality and integrity under specific conditions.
Mitigation Recommendations
No explicit patch or remediation is stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid relying on vulnerable versions of html_sanitize_ex (from 0.3.1 before 1.5.3) in security-critical contexts. Review usage of the <object> element in sanitized HTML and consider additional filtering or sanitization controls to restrict URI schemes and origins. Monitor vendor communications for official fixes or updates.
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to… (CVE-2026-66843)
Description
CVE-2026-66843 is a vulnerability in the HTML5 scrubber of the html_sanitize_ex library that allows a remote attacker to load arbitrary documents into a trusted page via the data attribute of an <object> element in sanitized HTML. The vulnerability arises because the <object> element is not properly registered or guarded against certain URI schemes, allowing mixed-case javascript:, data: URIs, protocol-relative URLs, and same-origin paths to bypass filtering. However, this does not result in unconditional cross-site scripting due to browser restrictions on javascript: URLs in <object data> and the opaque origin of data: documents. Exploitation requires the application to serve attacker-controlled content from a same-origin path. This issue affects html_sanitize_ex versions from 0.3.1 up to but not including 1.5.3.
CVSS v3.1
Score 6.1medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in html_sanitize_ex's HTML5 scrubber involves improper handling of the <object> element's data attribute, which is the only URI-bearing element not properly registered through allow_tag_with_uri_attributes/3. Its only guard is a prefix match on lowercase "javascript:", which allows bypasses via mixed-case javascript:, data: URIs, protocol-relative URLs, and same-origin paths. This enables a remote attacker to load a document of their choosing into a trusted page. While this does not lead to unconditional cross-site scripting due to browser protections and origin policies, it can lead to limited impact if the attacker can serve content from a same-origin path. The affected versions are html_sanitize_ex from 0.3.1 before 1.5.3. The CVSS v3.1 score is 6.1 (medium severity) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Potential Impact
The vulnerability allows an attacker to load arbitrary documents into a trusted page via the <object> element's data attribute in sanitized HTML. This can lead to limited confidentiality and integrity impacts due to the ability to load attacker-controlled content in the context of the trusted page. However, it does not enable unconditional cross-site scripting because javascript: URLs do not execute in <object data> in current browsers, data: URIs load in an opaque origin, and script execution requires the application to serve attacker-controlled content from a same-origin path. There is no impact on availability. Overall, the impact is limited but can affect confidentiality and integrity under specific conditions.
Mitigation Recommendations
No explicit patch or remediation is stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid relying on vulnerable versions of html_sanitize_ex (from 0.3.1 before 1.5.3) in security-critical contexts. Review usage of the <object> element in sanitized HTML and consider additional filtering or sanitization controls to restrict URI schemes and origins. Monitor vendor communications for official fixes or updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6g7x-33rf-28v3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-66843"]
- Ecosystems
- []
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a7b6fd2bf8831d5393ea910
Added to database: 08/11/2026, 18:54:10 UTC
Last enriched: 08/11/2026, 19:02:37 UTC
Last updated: 08/12/2026, 02:40:59 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.