Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not properly handle argument validation for unspecified variables, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "HTML Component Handling Vulnerability."
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-054
No PoCs found on GitHub currently.