CVE-2026-66843: htmlsanitizeex from 0.3.1 (inclusive), before 1.5.3 (exclusive); +1 more affected products

Affected technology

htmlsanitizeex · from 0.3.1 (inclusive), before 1.5.3 (exclusive)
rrrene

html_sanitize_ex · 0.3.1 to before 1.4.5, 1.5.0-rc.0 to before 1.5.3
rrrene

html_sanitize_ex · 8976d64ea0b77d26093a94a43ec48a3978e8d028 to before *; status changes: bec27fec4de99e40c68c4285a610e09e791a3eaf — unaffected, ce038aa1af5a960d50f8eb5d368cc57bb2b9a9f0 — unaffected
rrrene

Component: Elixir.HtmlSanitizeEx.Scrubber.HTML5, Elixir.HtmlSanitizeEx
Function: 'Elixir.HtmlSanitizeEx.Scrubber.HTML5':scrub_attribute/2, 'Elixir.HtmlSanitizeEx.Scrubber.HTML5':sanitize/1, 'Elixir.HtmlSanitizeEx':html5/1
File: lib/html_sanitize_ex/scrubber/html5.ex, lib/html_sanitize_ex.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

A remote attacker can load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive. Source advisory’s CVSS 4.0 assessment (base score 2.3/10) rates confidentiality, integrity and availability impact as none.