CVE-2026-68747

Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.3

Description An injection flaw exists in the CSS scrubber of the software, allowing an unauthenticated remote attacker to inject CSS at-rules, such as importing remote stylesheets, into pages served to other users. The HtmlSanitizeEx.Scrubber.CSS.scrub/1 function uses a regular expression to apply allowlists to property and value declarations; however, input that does not match this specific pattern is not inspected and is passed to the output unchanged. This allows @import rules to bypass the scrubber. Because element boundaries are resolved before the scrubber executes, the injected content remains within the <style> element and cannot execute scripts. This issue specifically affects applications using HtmlSanitizeEx.html5/1, custom scrubbers extending :html5 that permit <style> elements, or those calling HtmlSanitizeEx.Scrubber.CSS.scrub/1 directly.

Recommendations Update html sanitize ex to version 1.5.4 or later. Sanitize input using basic html/1, markdown html/1, or strip tags/1, as these do not allow <style> elements. Define a custom scrubber that omits the <style> element. Implement a Content-Security-Policy style-src directive that prohibits external stylesheet origins to prevent injected @import rules from loading.