AIKIDO-2026-995633
html_sanitize_ex is vulnerable to Inclusion of Functionality from Untrusted Control Sphere
23
Low Risk
This Affects:
html_sanitize_exTL;DR
The HTML5 scrubber allows the object element but never registers its data attribute for URI scheme checking, guarding it only with a lowercase javascript: prefix match. As a result mixed-case javascript:, data: URIs, protocol-relative URLs, and same-origin paths survive sanitizing, letting sanitized content load a document of the submitter's choosing into a trusted page. The fix validates the object data attribute against the URI scheme allowlist.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the HtmlSanitizeEx.html5/1 scrubber, or a custom scrubber extending :html5, and render the sanitized output to other users.
Background info
html_sanitize_ex is vulnerable to Inclusion of Functionality from Untrusted Control Sphere in versions 0.3.1 - 1.5.2.
How to fix this
Upgrade the html_sanitize_ex library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant