CVE-2026-68747: CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed.
Element boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes.
This issue affects htmlsanitizeex: from 0.3.1 before 1.5.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rrrene html_sanitize_exto a version that resolves this vulnerability.Fixed in 1.5.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68747?
CVE-2026-68747 has a risk rating of 37, indicating a notable level of severity.
How does CVE-2026-68747 affect rrrene/html_sanitize_ex?
CVE-2026-68747 allows an unauthenticated remote attacker to bypass the CSS sanitizer's allowlist and inject CSS at-rules into served pages.
Who can exploit CVE-2026-68747?
CVE-2026-68747 can be exploited by unauthenticated remote attackers.
What types of injections can occur due to CVE-2026-68747?
CVE-2026-68747 allows for the injection of CSS at-rules, including the potential import of remote stylesheets.
What steps should be taken to mitigate CVE-2026-68747?
Mitigation for CVE-2026-68747 involves updating to the latest version of rrrene/html_sanitize_ex that addresses this vulnerability.