AIKIDO-2026-995633
html_sanitize_ex is vulnerable to Inclusion of Functionality from Untrusted Control Sphere
23
CVE Score
Low
Inclusion of Functionality from Untrusted Control Sphere
TL;DR
The HTML5 scrubber allows the object element but never registers its data attribute for URI scheme checking, guarding it only with a lowercase javascript: prefix match. As a result mixed-case javascript:, data: URIs, protocol-relative URLs, and same-origin paths survive sanitizing, letting sanitized content load a document of the submitter's choosing into a trusted page. The fix validates the object data attribute against the URI scheme allowlist.
How do I fix this?
Upgrade the html_sanitize_ex library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the HtmlSanitizeEx.html5/1 scrubber, or a custom scrubber extending :html5, and render the sanitized output to other users.
Package
Versions
0.3.1 - 1.5.2
Fixed in 1.5.3Background info
html_sanitize_ex is vulnerable to Inclusion of Functionality from Untrusted Control Sphere in versions 0.3.1 - 1.5.2.
Links
GitHub Release
Fix Commits
github.com/rrrene/html_sanitize_ex/commit/bec27fec4de99e40c68c4285a610e09e791a3eafgithub.com/rrrene/html_sanitize_ex/commit/ce038aa1af5a960d50f8eb5d368cc57bb2b9a9f0
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.