AIKIDO-2026-995633
html_sanitize_ex is vulnerable to Inclusion of Functionality from Untrusted Control Sphere
23
Low Risk
This Affects:
html_sanitize_exTL;DR
The HTML5 scrubber allows the object element but never registers its data attribute for URI scheme checking, guarding it only with a lowercase javascript: prefix match. As a result mixed-case javascript:, data: URIs, protocol-relative URLs, and same-origin paths survive sanitizing, letting sanitized content load a document of the submitter's choosing into a trusted page. The fix validates the object data attribute against the URI scheme allowlist.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the HtmlSanitizeEx.html5/1 scrubber, or a custom scrubber extending :html5, and render the sanitized output to other users.
Background info
html_sanitize_ex is vulnerable to Inclusion of Functionality from Untrusted Control Sphere in versions 0.3.1 - 1.5.2.
How to fix this
Upgrade the html_sanitize_ex library to the patch version.
Links
GitHub Release
Fix Commits
github.com/rrrene/html_sanitize_ex/commit/bec27fec4de99e40c68c4285a610e09e791a3eafgithub.com/rrrene/html_sanitize_ex/commit/ce038aa1af5a960d50f8eb5d368cc57bb2b9a9f0
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.