Authored by fjl on Sep 17 2018, 11:48 AM.
The HTML tag <object> optionally has embedded (child) tags that serve as an alternative (fallback) HTML representation for the object. Of course, the object and its parameters are considered harmful in HTML mail, but the alternative representation is meant for exactly this kind of situation. They should display the object contents without loading possibly insecure code.
You should create pull requests on the upstream project page https://github.com/roundcube/roundcubemail/. For this change I'd also expect some test-cases.