The Drupal filter_xss_admin function in 5.x before 5.8 and 6.x before 6.3 does not \prevent use of the object HTML tag in administrator input \ which has unknown impact and attack vectors probably related to an insufficient cross-site scripting (XSS) protection mechanism.