CVE-2026-66843

CVE-2026-66843 affects html_sanitize_ex HTML5 scrubber. The vulnerability arises because the object element (data attribute) is not registered in allow_tag_with_uri_attributes/3, and the only guard is a lowercase javascript: prefix. This allows attacker-supplied content to be embedded in a truste...