Is CVE-2026-66843 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66843 being exploited in the wild.

How severe is CVE-2026-66843?

Medium severity, with a CVSS score of 6.1, published 6 August 2026.

Which products and versions are affected?

Rrrene Html Sanitize Ex 0.3.1 before 1.4.5 and 1.5.0-rc.0 before 1.5.3.

Is there a fix for CVE-2026-66843?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-66843 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-66843?

Check whether you run Rrrene Html Sanitize Ex or Rrrene Htmlsanitizeex at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66843: rrrene html_sanitize_ex object element URI bypass

CVE-2026-66843 · Severity: medium · CVSS 6.1 · Published 2026-08-06

html_sanitize_ex is an Elixir library used to sanitize HTML content by removing potentially malicious tags and attributes. A vulnerability in its HTML5 scrubber allows remote attackers to load untrusted documents (via data URIs, protocol-relative URLs, or same-origin paths) into the data attribute of object elements, potentially leading to data exposure or unauthorized script execution if the application serves attacker-controlled content from the same origin.

Technologies: Rrrene Html Sanitize Ex, Rrrene Htmlsanitizeex. Vendors: Rrrene.

Quick answers

Is CVE-2026-66843 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66843 being exploited in the wild.
How severe is CVE-2026-66843?: Medium severity, with a CVSS score of 6.1, published 6 August 2026.
Which products and versions are affected?: Rrrene Html Sanitize Ex 0.3.1 before 1.4.5 and 1.5.0-rc.0 before 1.5.3.
Is there a fix for CVE-2026-66843?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-66843 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-66843?: Check whether you run Rrrene Html Sanitize Ex or Rrrene Htmlsanitizeex at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a URI validation bypass vulnerability in the HTML5 scrubber component. The object element was never registered through allow_tag_with_uri_attributes/3, and its only guard is a case-sensitive prefix match for "javascript:" URLs. This allows mixed-case variants (e.g., "JavaScript:", "JaVaScript:"), data: URIs, protocol-relative URLs, and same-origin paths to pass through sanitization. An attacker can inject these into the data attribute of an object element within sanitized HTML. While javascript: URLs do not execute through object data in modern browsers and data: documents load in an opaque origin, exploitation becomes viable if the target application serves attacker-controlled content from the same origin as the trusted page. The vulnerability affects versions 0.3.1 through 1.4.4 and 1.5.0-rc.0 through 1.5.2; version 1.4.5 and 1.5.3 provide fixes.

Affected products

rrrene html_sanitize_ex 0.3.1 before 1.4.5 and 1.5.0-rc.0 before 1.5.3

Timeline

2026-08-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.