Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-66843— html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding

Quick assessment

Affected
rrrene html_sanitize_ex
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress Formidable Forms是WordPress基金会开源的一款表单创建插件。 René Föhring HtmlSanitizeEx 0.3.1版本至1.5.3之前版本存在软件供应链问题漏洞，该漏洞源于HTML5 scrubber对<object>元素的data属性处理不当，仅对“javascript:”前缀进行小写匹配，导致混合大小写变体、data: URI、协议相对URL和同源路径可绕过限制，可能允许远程攻击者将选择的文档加载到受信任页面中。

CVSS 2.3 · Low EPSS 0.51% · P43

Affected Version Matrix 3

VendorProduct Version RangeStatus
rrrene html_sanitize_ex 0.3.1< 1.4.5 affected
1.5.0-rc.0< 1.5.3 affected
8976d64ea0b77d26093a94a43ec48a3978e8d028< * affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-66843

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding
Source: CVE Program / CVE List V5
Vulnerability Description
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive. This is not unconditional cross-site scripting. A javascript: URL does not execute through <object data> in current browsers, data: documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
从非可信控制范围包含功能例程
Source: CVE Program / CVE List V5
Vulnerability Title
René Föhring HtmlSanitizeEx 软件供应链问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Formidable Forms是WordPress基金会开源的一款表单创建插件。 René Föhring HtmlSanitizeEx 0.3.1版本至1.5.3之前版本存在软件供应链问题漏洞，该漏洞源于HTML5 scrubber对<object>元素的data属性处理不当，仅对“javascript:”前缀进行小写匹配，导致混合大小写变体、data: URI、协议相对URL和同源路径可绕过限制，可能允许远程攻击者将选择的文档加载到受信任页面中。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
rrrene html_sanitize_ex 0.3.1 ~ 1.4.5 cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*
rrrene html_sanitize_ex 8976d64ea0b77d26093a94a43ec48a3978e8d028 ~ * cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-66843

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-66843

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-66843 (2)

Vendor Advisories for CVE-2026-66843 (2)

Other References for CVE-2026-66843 (1)

Same Patch Batch · rrrene · 2026-08-06 · 6 CVEs total

CVE-2026-68749 8.2 HIGH Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion de
CVE-2026-68750 8.2 HIGH Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaus
CVE-2026-66370 4.8 MEDIUM html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allow
CVE-2026-66829 2.3 LOW html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cros
CVE-2026-68747 2.3 LOW CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

IV. Related Vulnerabilities

Same product: html_sanitize_ex
Same vendor: rrrene
Same weakness: CWE-829