CVE-2026-68747 Details

A vulnerability has been identified in the CSS scrubber of the rrrene html_sanitize_ex library, versions 0.3.1 prior to 1.5.4. This vulnerability allows an unauthenticated remote attacker to inject CSS at-rules, including imports of remote stylesheets, into pages served to other users. The issue arises because the CSS scrubber's allowlist is applied through a regular expression that only inspects substrings matching a property-value declaration pattern. As a result, input that does not conform to this pattern is not properly sanitized and is output unchanged. For example, an '@import' rule can be successfully injected, while equivalent URLs in 'background' declarations are removed. The vulnerability is contained within the '<style>' element, preventing script execution.

Users can update to html_sanitize_ex version 1.5.4 or later, where this vulnerability has been fixed. Alternatively, for versions prior to 1.5.4, the 'HtmlSanitizeEx.basic_html/1', 'HtmlSanitizeEx.markdown_html/1', or 'HtmlSanitizeEx.strip_tags/1' functions can be used to sanitize content, as these do not allow '<style>' elements. If using a custom scrubber, ensure it does not permit '<style>' elements.