EEF-CVE-2026-66843

## Summary

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the `data` attribute of an `<object>` element in sanitized HTML. `object` is the one URI-bearing element in `lib/html_sanitize_ex/scrubber/html5.ex` never registered through `allow_tag_with_uri_attributes/3`, and its only guard is a prefix match on lowercase `"javascript:"`, so mixed-case variants, `data:` URIs, protocol-relative URLs and same-origin paths all survive.

This is not unconditional cross-site scripting. A `javascript:` URL does not execute through `<object data>` in current browsers, `data:` documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path.

This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.

## Workarounds

Sanitize with `basic_html/1`, `markdown_html/1` or `strip_tags/1`, none of which allow `object`, or define a custom scrubber that omits it.

A Content-Security-Policy of `object-src 'none'` blocks an injected `<object>` from loading, and hosting user uploads on a separate origin removes the escalation path.

## Configurations

Only `HtmlSanitizeEx.html5/1`, and custom scrubbers declared with `use HtmlSanitizeEx, extend: :html5`, allow the `object` element, and the sanitized output must be rendered to other users.

Script execution in the host origin additionally requires the application to serve attacker-controlled HTML from a same-origin path, such as an uploads directory served as `text/html`.