The HTML5 scrubber in rrrene:html_sanitize_ex does not remove <object> elements that use a data attribute, leaving an attacker able to request a document of their choice. Only a simple guard that checks for a lower‑case prefix of "javascript:" exists; alternative schemes such as data:, protocol‑relative URLs, mixed‑case "javascript:" or same‑origin paths are tolerated. Because a <object> data attribute does not execute JavaScript in modern browsers, this flaw does not provide unconditional XSS, but it does allow untrusted content to be embedded in a trusted page, potentially delivering hidden pages or malicious resources.

The vulnerability affects any deployment of the html_sanitize_ex library older than version 1.5.3, specifically those from 0.3.1 up to and including 1.5.2. The vendor is rrrene.

The CVSS score is 2.3, and the EPSS score is not available; the flaw is not listed in the CISA KEV catalog, indicating a low severity and low exploit probability. A remote attacker can supply untrusted HTML that yields the insecure <object> tag when passed through the sanitizer. The attack path relies on user input or other untrusted content sources being cleaned with the default scrubber. While the browser will block execution of an object containing a javascript: URL, data: URIs will load in an opaque origin, and same‑origin paths require the application to host attacker‑controlled content at that origin. Deployment of a Content Security Policy with object-src 'none', hosting uploads on a separate origin, or leveraging recommended alternative scrubbers can effectively mitigate the risk. The flaw’s impact is limited to content injection rather than direct code execution or privilege escalation.