CVE-2026-66843

The vulnerability CVE-2026-66843 affects html_sanitize_ex: from 0.3.1 before 1.5.3. The HTML5 scrubber does not register the tag in allow_tag_with_uri_attributes/3, and its only guard is a prefix check on javascript:, allowing attacker-supplied data: URLs to reach a trusted page via the data att...