EUVD-2026-54080
GHSA-6g7x-33rf-28v3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the additional same-origin file-serving precondition for meaningful impact; S:C captures embedded foreign document loading into trusted page scope; no availability impact applies.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
2DescriptionCVE.org
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive.
This is not unconditional cross-site scripting. A javascript: URL does not execute through <object data> in current browsers, data: documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path.
This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.
AnalysisAI
html_sanitize_ex's HTML5 scrubber (versions 0.3.1 through before 1.5.3) passes attacker-controlled URIs through the data attribute of <object> elements after a trivially bypassed case-sensitive prefix check, allowing remote attackers to embed arbitrary external or same-origin documents into sanitized pages viewed by victims. The <object> tag was never registered through the library's allow_tag_with_uri_attributes/3 URI-validation mechanism, and its sole guard - a literal lowercase javascript: prefix match - is defeated by mixed-case variants, data: URIs, protocol-relative URLs, and same-origin relative paths. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the application uses html_sanitize_ex 0.3.1 through before 1.5.3 with the HTML5 scrubber specifically; (2) untrusted user input reaches the scrubber and the sanitized output is rendered in a browser without further attribute stripping; and (3) the attacker can submit content containing an `<object>` element with a crafted `data` attribute using a mixed-case scheme (`JavaScript:`), a `data:` URI, a protocol-relative URL (`//attacker.example/...`), or a same-origin relative path (`/user-uploads/...`). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.3 (Low) and vector AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N is an accurate characterization of real-world risk and is consistent with the CVE description's explicit caveats. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade html_sanitize_ex to version 1.5.3 or later; this is the vendor-confirmed fix version per the GitHub advisory GHSA-xmm9-jc22-rcgj and is delivered by the patch commit at https://github.com/rrrene/html_sanitize_ex/commit/bec27fec4de99e40c68c4285a610e09e791a3eaf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Html Sanitize Ex
View allQuadratic CPU and memory exhaustion in html_sanitize_ex affects all applications that accept user-supplied HTML for sani
CPU exhaustion via quadratic regex backtracking in rrrene/html_sanitize_ex, an Elixir HTML sanitization library, allows
html_sanitize_ex's HTML5 scrubber (versions 0.3.1 through 1.5.2) permits the `form` and `formaction` attributes to survi
Open redirect in html_sanitize_ex (Elixir, versions 0.3.1 through 1.5.2) allows remote attackers to force page visitors
CSS at-rule injection in html_sanitize_ex (Elixir, versions 0.3.1-1.5.3) allows unauthenticated remote users to embed `@
Share
External POC / Exploit Code
Leaving vuln.today