Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2026-66843

Summary
Assigner-EEF
Assigner Org ID-6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published At-06 Aug, 2026 | 14:48
Updated At-06 Aug, 2026 | 14:48
Rejected At-
Credits

html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive. This is not unconditional cross-site scripting. A javascript: URL does not execute through <object data> in current browsers, data: documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path. This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:EEF
Assigner Org ID:6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published At:06 Aug, 2026 | 14:48
Updated At:06 Aug, 2026 | 14:48
Rejected At:
▼CVE Numbering Authority (CNA)
html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive. This is not unconditional cross-site scripting. A javascript: URL does not execute through <object data> in current browsers, data: documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path. This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.

Affected Products
Vendor
rrrene
Product
html_sanitize_ex
Collection URL
https://repo.hex.pm
Package Name
html_sanitize_ex
Repo
https://github.com/rrrene/html_sanitize_ex
CPEs
  • cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*
Modules
  • Elixir.HtmlSanitizeEx.Scrubber.HTML5
  • Elixir.HtmlSanitizeEx
Program Files
  • lib/html_sanitize_ex/scrubber/html5.ex
  • lib/html_sanitize_ex.ex
Program Routines
  • 'Elixir.HtmlSanitizeEx.Scrubber.HTML5':scrub_attribute/2
  • 'Elixir.HtmlSanitizeEx.Scrubber.HTML5':sanitize/1
  • 'Elixir.HtmlSanitizeEx':html5/1
Default Status
unaffected
Versions
Affected
  • From 0.3.1 before 1.5.3 (semver)
Vendor
rrrene
Product
html_sanitize_ex
Collection URL
https://github.com
Package Name
rrrene/html_sanitize_ex
Repo
https://github.com/rrrene/html_sanitize_ex
CPEs
  • cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*
Modules
  • Elixir.HtmlSanitizeEx.Scrubber.HTML5
  • Elixir.HtmlSanitizeEx
Program Files
  • lib/html_sanitize_ex/scrubber/html5.ex
  • lib/html_sanitize_ex.ex
Program Routines
  • 'Elixir.HtmlSanitizeEx.Scrubber.HTML5':scrub_attribute/2
  • 'Elixir.HtmlSanitizeEx.Scrubber.HTML5':sanitize/1
  • 'Elixir.HtmlSanitizeEx':html5/1
Default Status
unaffected
Versions
Affected
  • From 8976d64ea0b77d26093a94a43ec48a3978e8d028 before bec27fec4de99e40c68c4285a610e09e791a3eaf (git)
Problem Types
TypeCWE IDDescription
CWECWE-829CWE-829 Inclusion of Functionality from Untrusted Control Sphere
Type: CWE
CWE ID: CWE-829
Description: CWE-829 Inclusion of Functionality from Untrusted Control Sphere
Metrics
VersionBase scoreBase severityVector
4.02.3LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Version: 4.0
Base score: 2.3
Base severity: LOW
Vector:
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-175CAPEC-175 Code Inclusion
CAPEC ID: CAPEC-175
Description: CAPEC-175 Code Inclusion
Solutions
Configurations

Only HtmlSanitizeEx.html5/1, and custom scrubbers declared with use HtmlSanitizeEx, extend: :html5, allow the object element, and the sanitized output must be rendered to other users. Script execution in the host origin additionally requires the application to serve attacker-controlled HTML from a same-origin path, such as an uploads directory served as text/html.

Workarounds

Sanitize with basic_html/1, markdown_html/1 or strip_tags/1, none of which allow object, or define a custom scrubber that omits it. A Content-Security-Policy of object-src 'none' blocks an injected <object> from loading, and hosting user uploads on a separate origin removes the escalation path.

Exploits
Credits
finder
Peter Ullrich
remediation developer
René Föhring
analyst
Jonatan Männchen / EEF
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-xmm9-jc22-rcgj
vendor-advisory
related
https://cna.erlef.org/cves/CVE-2026-66843.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-66843
related
https://github.com/rrrene/html_sanitize_ex/commit/bec27fec4de99e40c68c4285a610e09e791a3eaf
patch
Hyperlink: https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-xmm9-jc22-rcgj
Resource:
vendor-advisory
related
Hyperlink: https://cna.erlef.org/cves/CVE-2026-66843.html
Resource:
related
Hyperlink: https://osv.dev/vulnerability/EEF-CVE-2026-66843
Resource:
related
Hyperlink: https://github.com/rrrene/html_sanitize_ex/commit/bec27fec4de99e40c68c4285a610e09e791a3eaf
Resource:
patch
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published At:06 Aug, 2026 | 16:16
Updated At:06 Aug, 2026 | 16:16

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive. This is not unconditional cross-site scripting. A javascript: URL does not execute through <object data> in current browsers, data: documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path. This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.02.3LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Type: Secondary
Version: 4.0
Base score: 2.3
Base severity: LOW
Vector:
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-829Secondary6b3ad84c-e1a6-4bf7-a703-f496b71e49db
CWE ID: CWE-829
Type: Secondary
Source: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://cna.erlef.org/cves/CVE-2026-66843.html6b3ad84c-e1a6-4bf7-a703-f496b71e49db
N/A
https://github.com/rrrene/html_sanitize_ex/commit/bec27fec4de99e40c68c4285a610e09e791a3eaf6b3ad84c-e1a6-4bf7-a703-f496b71e49db
N/A
https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-xmm9-jc22-rcgj6b3ad84c-e1a6-4bf7-a703-f496b71e49db
N/A
https://osv.dev/vulnerability/EEF-CVE-2026-668436b3ad84c-e1a6-4bf7-a703-f496b71e49db
N/A
Hyperlink: https://cna.erlef.org/cves/CVE-2026-66843.html
Source: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Resource: N/A
Hyperlink: https://github.com/rrrene/html_sanitize_ex/commit/bec27fec4de99e40c68c4285a610e09e791a3eaf
Source: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Resource: N/A
Hyperlink: https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-xmm9-jc22-rcgj
Source: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Resource: N/A
Hyperlink: https://osv.dev/vulnerability/EEF-CVE-2026-66843
Source: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

1Records found
CVE-2026-68747
Matching Score-8
Assigner-6b3ad84c-e1a6-4bf7-a703-f496b71e49db
ShareView Details
Matching Score-8
Assigner-6b3ad84c-e1a6-4bf7-a703-f496b71e49db
CVSS Score-2.3||LOW
EPSS-Not Assigned
Published-06 Aug, 2026 | 14:50
Updated-06 Aug, 2026 | 16:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed. Element boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes. This issue affects html_sanitize_ex: from 0.3.1 before 1.5.4.

Action-Not Available
Vendor-rrrene
Product-html_sanitize_ex
CWE ID-CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Details not found