GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-66843 (GCVE-0-2026-66843)

Vulnerability from cvelistv5 – Published: 2026-08-06 14:48 – Updated: 2026-08-19 11:51
VLAI
Title
html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding
Summary
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive. This is not unconditional cross-site scripting. A javascript: URL does not execute through <object data> in current browsers, data: documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.
Severity
2.3 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 15:40 UTC
CWE
  • CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
Assigner
References
Impacted products
Vendor Product Version CPE status
rrrene html_sanitize_ex Affected: 0.3.1 , < 1.4.5 (semver)
Affected: 1.5.0-rc.0 , < 1.5.3 (semver)
    cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*
Create a notification for this product.
rrrene html_sanitize_ex Affected: 8976d64ea0b77d26093a94a43ec48a3978e8d028 , < * (git)
    cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Peter Ullrich René Föhring Jonatan Männchen / EEF
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66843",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T15:40:41.682905Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T15:40:50.570Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Elixir.HtmlSanitizeEx.Scrubber.HTML5",
            "Elixir.HtmlSanitizeEx"
          ],
          "packageName": "html_sanitize_ex",
          "packageURL": "pkg:hex/html_sanitize_ex",
          "product": "html_sanitize_ex",
          "programFiles": [
            "lib/html_sanitize_ex/scrubber/html5.ex",
            "lib/html_sanitize_ex.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:scrub_attribute/2"
            },
            {
              "name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:sanitize/1"
            },
            {
              "name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
            }
          ],
          "repo": "https://github.com/rrrene/html_sanitize_ex",
          "vendor": "rrrene",
          "versions": [
            {
              "lessThan": "1.4.5",
              "status": "affected",
              "version": "0.3.1",
              "versionType": "semver"
            },
            {
              "lessThan": "1.5.3",
              "status": "affected",
              "version": "1.5.0-rc.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Elixir.HtmlSanitizeEx.Scrubber.HTML5",
            "Elixir.HtmlSanitizeEx"
          ],
          "packageName": "rrrene/html_sanitize_ex",
          "packageURL": "pkg:github/rrrene/html_sanitize_ex",
          "product": "html_sanitize_ex",
          "programFiles": [
            "lib/html_sanitize_ex/scrubber/html5.ex",
            "lib/html_sanitize_ex.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:scrub_attribute/2"
            },
            {
              "name": "\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:sanitize/1"
            },
            {
              "name": "\u0027Elixir.HtmlSanitizeEx\u0027:html5/1"
            }
          ],
          "repo": "https://github.com/rrrene/html_sanitize_ex",
          "vendor": "rrrene",
          "versions": [
            {
              "changes": [
                {
                  "at": "bec27fec4de99e40c68c4285a610e09e791a3eaf",
                  "status": "unaffected"
                },
                {
                  "at": "ce038aa1af5a960d50f8eb5d368cc57bb2b9a9f0",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "8976d64ea0b77d26093a94a43ec48a3978e8d028",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOnly \u003ccode\u003eHtmlSanitizeEx.html5/1\u003c/code\u003e, and custom scrubbers declared with \u003ccode\u003euse HtmlSanitizeEx, extend: :html5\u003c/code\u003e, allow the \u003ccode\u003eobject\u003c/code\u003e element, and the sanitized output must be rendered to other users.\u003c/p\u003e\n\u003cp\u003eScript execution in the host origin additionally requires the application to serve attacker-controlled HTML from a same-origin path, such as an uploads directory served as \u003ccode\u003etext/html\u003c/code\u003e.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Only `HtmlSanitizeEx.html5/1`, and custom scrubbers declared with `use HtmlSanitizeEx, extend: :html5`, allow the `object` element, and the sanitized output must be rendered to other users.\n\nScript execution in the host origin additionally requires the application to serve attacker-controlled HTML from a same-origin path, such as an uploads directory served as `text/html`."
            }
          ],
          "value": "Only HtmlSanitizeEx.html5/1, and custom scrubbers declared with use HtmlSanitizeEx, extend: :html5, allow the object element, and the sanitized output must be rendered to other users.\n\nScript execution in the host origin additionally requires the application to serve attacker-controlled HTML from a same-origin path, such as an uploads directory served as text/html."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.4.5",
                  "versionStartIncluding": "0.3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.5.3",
                  "versionStartIncluding": "1.5.0-rc.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ren\u00e9 F\u00f6hring"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the \u003ccode\u003edata\u003c/code\u003e attribute of an \u003ccode\u003e\u0026lt;object\u0026gt;\u003c/code\u003e element in sanitized HTML. \u003ccode\u003eobject\u003c/code\u003e is the one URI-bearing element in \u003ccode\u003elib/html_sanitize_ex/scrubber/html5.ex\u003c/code\u003e never registered through \u003ccode\u003eallow_tag_with_uri_attributes/3\u003c/code\u003e, and its only guard is a prefix match on lowercase \u003ccode\u003e\"javascript:\"\u003c/code\u003e, so mixed-case variants, \u003ccode\u003edata:\u003c/code\u003e URIs, protocol-relative URLs and same-origin paths all survive.\u003c/p\u003e\n\u003cp\u003eThis is not unconditional cross-site scripting. A \u003ccode\u003ejavascript:\u003c/code\u003e URL does not execute through \u003ccode\u003e\u0026lt;object data\u0026gt;\u003c/code\u003e in current browsers, \u003ccode\u003edata:\u003c/code\u003e documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path.\u003c/p\u003e\n\u003cp\u003eThis issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the `data` attribute of an `\u003cobject\u003e` element in sanitized HTML. `object` is the one URI-bearing element in `lib/html_sanitize_ex/scrubber/html5.ex` never registered through `allow_tag_with_uri_attributes/3`, and its only guard is a prefix match on lowercase `\"javascript:\"`, so mixed-case variants, `data:` URIs, protocol-relative URLs and same-origin paths all survive.\n\nThis is not unconditional cross-site scripting. A `javascript:` URL does not execute through `\u003cobject data\u003e` in current browsers, `data:` documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3."
            }
          ],
          "value": "Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an \u003cobject\u003e element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase \"javascript:\", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive.\n\nThis is not unconditional cross-site scripting. A javascript: URL does not execute through \u003cobject data\u003e in current browsers, data: documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-175",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-175 Code Inclusion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T11:51:46.161Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-xmm9-jc22-rcgj"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-66843.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-66843"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/rrrene/html_sanitize_ex/commit/bec27fec4de99e40c68c4285a610e09e791a3eaf"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/rrrene/html_sanitize_ex/commit/ce038aa1af5a960d50f8eb5d368cc57bb2b9a9f0"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "html_sanitize_ex HTML5 scrubber keeps attacker-supplied `\u003cobject\u003e` elements, allowing untrusted content embedding",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSanitize with \u003ccode\u003ebasic_html/1\u003c/code\u003e, \u003ccode\u003emarkdown_html/1\u003c/code\u003e or \u003ccode\u003estrip_tags/1\u003c/code\u003e, none of which allow \u003ccode\u003eobject\u003c/code\u003e, or define a custom scrubber that omits it.\u003c/p\u003e\n\u003cp\u003eA Content-Security-Policy of \u003ccode\u003eobject-src \u0027none\u0027\u003c/code\u003e blocks an injected \u003ccode\u003e\u0026lt;object\u0026gt;\u003c/code\u003e from loading, and hosting user uploads on a separate origin removes the escalation path.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Sanitize with `basic_html/1`, `markdown_html/1` or `strip_tags/1`, none of which allow `object`, or define a custom scrubber that omits it.\n\nA Content-Security-Policy of `object-src \u0027none\u0027` blocks an injected `\u003cobject\u003e` from loading, and hosting user uploads on a separate origin removes the escalation path."
            }
          ],
          "value": "Sanitize with basic_html/1, markdown_html/1 or strip_tags/1, none of which allow object, or define a custom scrubber that omits it.\n\nA Content-Security-Policy of object-src \u0027none\u0027 blocks an injected \u003cobject\u003e from loading, and hosting user uploads on a separate origin removes the escalation path."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-66843",
    "datePublished": "2026-08-06T14:48:20.513Z",
    "dateReserved": "2026-08-06T09:00:01.259Z",
    "dateUpdated": "2026-08-19T11:51:46.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-66843",
      "date": "2026-09-15",
      "epss": "0.0029",
      "percentile": "0.21538"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-66843\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-08-06T16:16:49.627\",\"lastModified\":\"2026-08-19T12:18:34.807\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an \u003cobject\u003e element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase \\\"javascript:\\\", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive.\\n\\nThis is not unconditional cross-site scripting. A javascript: URL does not execute through \u003cobject data\u003e in current browsers, data: documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path.\\n\\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"rrrene\",\"product\":\"html_sanitize_ex\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.hex.pm\",\"packageName\":\"html_sanitize_ex\",\"cpes\":[\"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*\"],\"modules\":[\"Elixir.HtmlSanitizeEx.Scrubber.HTML5\",\"Elixir.HtmlSanitizeEx\"],\"programFiles\":[\"lib/html_sanitize_ex/scrubber/html5.ex\",\"lib/html_sanitize_ex.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:scrub_attribute/2\"},{\"name\":\"\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:sanitize/1\"},{\"name\":\"\u0027Elixir.HtmlSanitizeEx\u0027:html5/1\"}],\"repo\":\"https://github.com/rrrene/html_sanitize_ex\",\"packageURL\":\"pkg:hex/html_sanitize_ex\",\"versions\":[{\"version\":\"0.3.1\",\"lessThan\":\"1.4.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"1.5.0-rc.0\",\"lessThan\":\"1.5.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"rrrene\",\"product\":\"html_sanitize_ex\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"rrrene/html_sanitize_ex\",\"cpes\":[\"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*\"],\"modules\":[\"Elixir.HtmlSanitizeEx.Scrubber.HTML5\",\"Elixir.HtmlSanitizeEx\"],\"programFiles\":[\"lib/html_sanitize_ex/scrubber/html5.ex\",\"lib/html_sanitize_ex.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:scrub_attribute/2\"},{\"name\":\"\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:sanitize/1\"},{\"name\":\"\u0027Elixir.HtmlSanitizeEx\u0027:html5/1\"}],\"repo\":\"https://github.com/rrrene/html_sanitize_ex\",\"packageURL\":\"pkg:github/rrrene/html_sanitize_ex\",\"versions\":[{\"version\":\"8976d64ea0b77d26093a94a43ec48a3978e8d028\",\"lessThan\":\"*\",\"versionType\":\"git\",\"status\":\"affected\",\"changes\":[{\"at\":\"bec27fec4de99e40c68c4285a610e09e791a3eaf\",\"status\":\"unaffected\"},{\"at\":\"ce038aa1af5a960d50f8eb5d368cc57bb2b9a9f0\",\"status\":\"unaffected\"}]}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":2.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-06T15:40:41.682905Z\",\"id\":\"CVE-2026-66843\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-829\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rrrene:htmlsanitizeex:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.3.1\",\"versionEndExcluding\":\"1.5.3\",\"matchCriteriaId\":\"DE85053C-AE84-4570-A90C-4D4CCD7A4BA3\"}]}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-66843.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/rrrene/html_sanitize_ex/commit/bec27fec4de99e40c68c4285a610e09e791a3eaf\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/rrrene/html_sanitize_ex/commit/ce038aa1af5a960d50f8eb5d368cc57bb2b9a9f0\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-xmm9-jc22-rcgj\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-66843\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"tags\":[\"Patch\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-66843\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-06T15:40:41.682905Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-06T15:40:45.891Z\"}}], \"cna\": {\"title\": \"html_sanitize_ex HTML5 scrubber keeps attacker-supplied `\u003cobject\u003e` elements, allowing untrusted content embedding\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Ren\\u00e9 F\\u00f6hring\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-175\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-175 Code Inclusion\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 2.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"LOW\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/rrrene/html_sanitize_ex\", \"vendor\": \"rrrene\", \"modules\": [\"Elixir.HtmlSanitizeEx.Scrubber.HTML5\", \"Elixir.HtmlSanitizeEx\"], \"product\": \"html_sanitize_ex\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.3.1\", \"lessThan\": \"1.4.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.5.0-rc.0\", \"lessThan\": \"1.5.3\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/html_sanitize_ex\", \"packageName\": \"html_sanitize_ex\", \"programFiles\": [\"lib/html_sanitize_ex/scrubber/html5.ex\", \"lib/html_sanitize_ex.ex\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:scrub_attribute/2\"}, {\"name\": \"\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:sanitize/1\"}, {\"name\": \"\u0027Elixir.HtmlSanitizeEx\u0027:html5/1\"}]}, {\"cpes\": [\"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/rrrene/html_sanitize_ex\", \"vendor\": \"rrrene\", \"modules\": [\"Elixir.HtmlSanitizeEx.Scrubber.HTML5\", \"Elixir.HtmlSanitizeEx\"], \"product\": \"html_sanitize_ex\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"bec27fec4de99e40c68c4285a610e09e791a3eaf\", \"status\": \"unaffected\"}, {\"at\": \"ce038aa1af5a960d50f8eb5d368cc57bb2b9a9f0\", \"status\": \"unaffected\"}], \"version\": \"8976d64ea0b77d26093a94a43ec48a3978e8d028\", \"lessThan\": \"*\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/rrrene/html_sanitize_ex\", \"packageName\": \"rrrene/html_sanitize_ex\", \"programFiles\": [\"lib/html_sanitize_ex/scrubber/html5.ex\", \"lib/html_sanitize_ex.ex\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:scrub_attribute/2\"}, {\"name\": \"\u0027Elixir.HtmlSanitizeEx.Scrubber.HTML5\u0027:sanitize/1\"}, {\"name\": \"\u0027Elixir.HtmlSanitizeEx\u0027:html5/1\"}]}], \"references\": [{\"url\": \"https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-xmm9-jc22-rcgj\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-66843.html\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-66843\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/rrrene/html_sanitize_ex/commit/bec27fec4de99e40c68c4285a610e09e791a3eaf\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/rrrene/html_sanitize_ex/commit/ce038aa1af5a960d50f8eb5d368cc57bb2b9a9f0\", \"tags\": [\"patch\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Sanitize with basic_html/1, markdown_html/1 or strip_tags/1, none of which allow object, or define a custom scrubber that omits it.\\n\\nA Content-Security-Policy of object-src \u0027none\u0027 blocks an injected \u003cobject\u003e from loading, and hosting user uploads on a separate origin removes the escalation path.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eSanitize with \u003ccode\u003ebasic_html/1\u003c/code\u003e, \u003ccode\u003emarkdown_html/1\u003c/code\u003e or \u003ccode\u003estrip_tags/1\u003c/code\u003e, none of which allow \u003ccode\u003eobject\u003c/code\u003e, or define a custom scrubber that omits it.\u003c/p\u003e\\n\u003cp\u003eA Content-Security-Policy of \u003ccode\u003eobject-src \u0027none\u0027\u003c/code\u003e blocks an injected \u003ccode\u003e\u0026lt;object\u0026gt;\u003c/code\u003e from loading, and hosting user uploads on a separate origin removes the escalation path.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"Sanitize with `basic_html/1`, `markdown_html/1` or `strip_tags/1`, none of which allow `object`, or define a custom scrubber that omits it.\\n\\nA Content-Security-Policy of `object-src \u0027none\u0027` blocks an injected `\u003cobject\u003e` from loading, and hosting user uploads on a separate origin removes the escalation path.\", \"base64\": false}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an \u003cobject\u003e element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase \\\"javascript:\\\", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive.\\n\\nThis is not unconditional cross-site scripting. A javascript: URL does not execute through \u003cobject data\u003e in current browsers, data: documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path.\\n\\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eInclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the \u003ccode\u003edata\u003c/code\u003e attribute of an \u003ccode\u003e\u0026lt;object\u0026gt;\u003c/code\u003e element in sanitized HTML. \u003ccode\u003eobject\u003c/code\u003e is the one URI-bearing element in \u003ccode\u003elib/html_sanitize_ex/scrubber/html5.ex\u003c/code\u003e never registered through \u003ccode\u003eallow_tag_with_uri_attributes/3\u003c/code\u003e, and its only guard is a prefix match on lowercase \u003ccode\u003e\\\"javascript:\\\"\u003c/code\u003e, so mixed-case variants, \u003ccode\u003edata:\u003c/code\u003e URIs, protocol-relative URLs and same-origin paths all survive.\u003c/p\u003e\\n\u003cp\u003eThis is not unconditional cross-site scripting. A \u003ccode\u003ejavascript:\u003c/code\u003e URL does not execute through \u003ccode\u003e\u0026lt;object data\u0026gt;\u003c/code\u003e in current browsers, \u003ccode\u003edata:\u003c/code\u003e documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path.\u003c/p\u003e\\n\u003cp\u003eThis issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the `data` attribute of an `\u003cobject\u003e` element in sanitized HTML. `object` is the one URI-bearing element in `lib/html_sanitize_ex/scrubber/html5.ex` never registered through `allow_tag_with_uri_attributes/3`, and its only guard is a prefix match on lowercase `\\\"javascript:\\\"`, so mixed-case variants, `data:` URIs, protocol-relative URLs and same-origin paths all survive.\\n\\nThis is not unconditional cross-site scripting. A `javascript:` URL does not execute through `\u003cobject data\u003e` in current browsers, `data:` documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path.\\n\\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-829\", \"description\": \"CWE-829 Inclusion of Functionality from Untrusted Control Sphere\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"Only HtmlSanitizeEx.html5/1, and custom scrubbers declared with use HtmlSanitizeEx, extend: :html5, allow the object element, and the sanitized output must be rendered to other users.\\n\\nScript execution in the host origin additionally requires the application to serve attacker-controlled HTML from a same-origin path, such as an uploads directory served as text/html.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eOnly \u003ccode\u003eHtmlSanitizeEx.html5/1\u003c/code\u003e, and custom scrubbers declared with \u003ccode\u003euse HtmlSanitizeEx, extend: :html5\u003c/code\u003e, allow the \u003ccode\u003eobject\u003c/code\u003e element, and the sanitized output must be rendered to other users.\u003c/p\u003e\\n\u003cp\u003eScript execution in the host origin additionally requires the application to serve attacker-controlled HTML from a same-origin path, such as an uploads directory served as \u003ccode\u003etext/html\u003c/code\u003e.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"Only `HtmlSanitizeEx.html5/1`, and custom scrubbers declared with `use HtmlSanitizeEx, extend: :html5`, allow the `object` element, and the sanitized output must be rendered to other users.\\n\\nScript execution in the host origin additionally requires the application to serve attacker-controlled HTML from a same-origin path, such as an uploads directory served as `text/html`.\", \"base64\": false}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"1.4.5\", \"versionStartIncluding\": \"0.3.1\"}, {\"criteria\": \"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"1.5.3\", \"versionStartIncluding\": \"1.5.0-rc.0\"}], \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-08-19T11:51:46.161Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-66843\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-19T11:51:46.161Z\", \"dateReserved\": \"2026-08-06T09:00:01.259Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-08-06T14:48:20.513Z\", \"assignerShortName\": \"EEF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.