The HTML5 scrubber in rrrene:html_sanitize_ex fails to remove <object> elements that use a data attribute. This vulnerability is categorized as CWE-829. The <object> element is the only element that can contain a URI in the scrubber, and it is not registered with the allow_tag_with_uri_attributes function; its sole check is a lowercase "javascript:" prefix match. As a result, mixed‑case variants, data: URIs, protocol‑relative URLs and same‑origin paths all remain in sanitized HTML. While <object> data attributes do not directly execute JavaScript in modern browsers, the accepted data: URIs load documents in an opaque origin, giving an attacker a route to embed untrusted content, potentially bypassing same‑origin restrictions if the host serves attacker‑controlled documents. This flaw does not provide unconditional XSS but allows the embedding of untrusted resources, which could be used to host hidden pages or malicious content.

The vulnerability affects any deployment of the html_sanitize_ex library older than version 1.5.3, specifically those from 0.3.1 up to and including 1.5.2. The vendor is rrrene.

The CVSS score is 2.3, and the EPSS score is 0.0029; the flaw is not listed in the CISA KEV catalog, indicating a low severity and low exploit probability. A remote attacker can supply untrusted HTML that yields the insecure <object> tag when passed through the sanitizer. The attack path relies on user input or other untrusted content sources being cleaned with the default scrubber. While the browser will block execution of an object containing a javascript: URL, data: URIs will load in an opaque origin, and same‑origin paths require the application to host attacker‑controlled content at that origin. Deployment of a Content Security Policy with object-src 'none', hosting uploads on a separate origin, or leveraging recommended alternative scrubbers can effectively mitigate the risk. The flaw’s impact is limited to content injection rather than direct code execution or privilege escalation.