LOWpublic-safe

CVE-2026-66843

NVD: Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in... NVD: object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", so mixed-case variants, data: URIs, protocol-relative... NVD: This is not unconditional cross-site scripting.

CVSS
2.3 Severity
LOW EPSS
0.0029 (21) KEV
-

Source-published summary

Possible impact

Source describes XSS risk · remote exposure. Possible impact: This low severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk · remote exposure.

Affected context

vendor/product: rrrene / htmlsanitizeex

Remediation / advisory

Remediation reference present; patch status requires confirmation in the linked advisory.

Why it matters

Source describes XSS risk · remote exposure. Possible impact: This low severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk · remote exposure.; CVSS 2.3 (LOW); EPSS percentile 21; not listed in KEV; Remediation reference present; patch status requires confirmation in the linked advisory; sources: NVD, OSV.

What to verify

Confirm affected product/version, vendor advisory, patch or mitigation, and exposure.

Exposure hint

remote exposure

Impact tags

XSS riskremote exposure relevant

Urgency reasons

affected product presentvendor advisory presentrecent updateremediation reference present

Source-derived note

Summary derived from NVD / OSV description; unsafe procedural detail is not shown.

Redaction metadata

source summary used: True
fallback summary used: False
unsafe procedural detail present: false
raw source displayed: false
public summary redacted: true

Remediation handoff

Public-safe static handoff for human/Codex remediation planning. Scan, patch, external execution, and auto remediation are disabled.

Handoff JSON Handoff Markdown Safe Codex prompt

Safety note

This radar shows source-published defensive context only. Exploit procedures, exploit strings, scanner commands, and auto-remediation are not provided.