CVE-2026-66843 Details

A vulnerability allowing the inclusion of functionality from an untrusted control sphere has been identified in the HTML5 scrubber of rrrene html_sanitize_ex, versions 0.3.1 prior to 1.5.3. This vulnerability allows remote attackers to load arbitrary documents into a trusted page using the data attribute of an <object> element within sanitized HTML. The <object> element is the only URI-bearing element in the HTML5 scrubber that is not properly sanitized, as it is not registered to allow URI attributes and only filters out lowercase 'javascript:' URLs. As a result, mixed-case 'javascript:' URLs, 'data:' URIs, protocol-relative URLs, and same-origin paths can bypass the sanitation and remain intact. While this vulnerability does not constitute unconditional cross-site scripting—since 'javascript:' URLs do not execute via <object data> in current browsers, 'data:' documents are loaded in an opaque origin, and executing scripts from the host origin requires serving attacker-controlled content from a same-origin path— it still poses a significant risk by allowing untrusted content to be embedded in a trusted context.

Users can update to rrrene html_sanitize_ex version 1.5.3 or later, where this vulnerability has been fixed. Alternatively, a custom scrubber can be defined that omits the <object> element, or one can use the 'basic_html', 'markdown_html', or 'strip_tags' functions, which do not allow <object> elements. For applications that host user uploads, serving these files from a separate origin can also mitigate the risk.