# CVE-2026-66843: rrrene html_sanitize_ex object element URI bypass

Source: https://junglewise.ai/threats/cve-2026-66843-rrrene-html-sanitize-ex-object-element-uri-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-66843 · Severity: medium · CVSS 6.1 · Published 2026-08-06

html_sanitize_ex is an Elixir library used to sanitize HTML content by removing potentially malicious tags and attributes. A vulnerability in its HTML5 scrubber allows remote attackers to load untrusted documents (via data URIs, protocol-relative URLs, or same-origin paths) into the data attribute of object elements, potentially leading to data exposure or unauthorized script execution if the application serves attacker-controlled content from the same origin.

Technologies: [Rrrene Html Sanitize Ex](https://junglewise.ai/threats/technologies/html-sanitize-ex), [Rrrene Htmlsanitizeex](https://junglewise.ai/threats/technologies/htmlsanitizeex). Vendors: [Rrrene](https://junglewise.ai/threats/vendors/rrrene).

## Quick answers

**Is CVE-2026-66843 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66843 being exploited in the wild.

**How severe is CVE-2026-66843?** Medium severity, with a CVSS score of 6.1, published 6 August 2026.

**Which products and versions are affected?** Rrrene Html Sanitize Ex 0.3.1 before 1.4.5 and 1.5.0-rc.0 before 1.5.3.

**Is there a fix for CVE-2026-66843?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-66843 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66843?** Check whether you run Rrrene Html Sanitize Ex or Rrrene Htmlsanitizeex at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a URI validation bypass vulnerability in the HTML5 scrubber component. The object element was never registered through allow_tag_with_uri_attributes/3, and its only guard is a case-sensitive prefix match for "javascript:" URLs. This allows mixed-case variants (e.g., "JavaScript:", "JaVaScript:"), data: URIs, protocol-relative URLs, and same-origin paths to pass through sanitization. An attacker can inject these into the data attribute of an object element within sanitized HTML. While javascript: URLs do not execute through object data in modern browsers and data: documents load in an opaque origin, exploitation becomes viable if the target application serves attacker-controlled content from the same origin as the trusted page. The vulnerability affects versions 0.3.1 through 1.4.4 and 1.5.0-rc.0 through 1.5.2; version 1.4.5 and 1.5.3 provide fixes.

## Affected products

- rrrene html_sanitize_ex 0.3.1 before 1.4.5 and 1.5.0-rc.0 before 1.5.3

## Timeline

- 2026-08-06: disclosed

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)

## Related threats

- [rrrene html_sanitize_ex algorithmic complexity DoS](https://junglewise.ai/threats/cve-2026-68750-rrrene-html-sanitize-ex-algorithmic-complexity-dos)
- [rrrene html_sanitize_ex ReDoS in CSS scrubber](https://junglewise.ai/threats/cve-2026-68749-rrrene-html-sanitize-ex-redos-in-css-scrubber)
- [rrrene html_sanitize_ex CSS injection via unvalidated at-rules](https://junglewise.ai/threats/cve-2026-68747-rrrene-html-sanitize-ex-css-injection-via-unvalidated-at-rules)
- [rrrene html_sanitize_ex open redirect in meta refresh](https://junglewise.ai/threats/cve-2026-66829-rrrene-html-sanitize-ex-open-redirect-in-meta-refresh)
- [rrrene html_sanitize_ex open redirect via form attributes](https://junglewise.ai/threats/cve-2026-66370-rrrene-html-sanitize-ex-open-redirect-via-form-attributes)