{"id":"EEF-CVE-2026-68747","summary":"CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input","details":"## Summary\n\nImproper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. `HtmlSanitizeEx.Scrubber.CSS.scrub/1` applies its property and value allowlist through a `Regex.replace` over substrings matching a `property: value` declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. `@import url(//attacker.example/style.css);` survives, while the same URL inside a `background: url(...)` declaration is removed.\n\nElement boundaries are resolved before the scrubber runs, so injected content does not escape the `\u003cstyle\u003e` element and no script executes.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.4.\n\n## Workarounds\n\nSanitize with `basic_html/1`, `markdown_html/1` or `strip_tags/1`, none of which allow `\u003cstyle\u003e` elements, or define a custom scrubber that omits it.\n\nA Content-Security-Policy `style-src` directive that permits no external stylesheet origins stops an injected `@import` from loading, though injected inline rules still apply.\n\n## Configurations\n\nOnly `HtmlSanitizeEx.html5/1`, and custom scrubbers declared with `use HtmlSanitizeEx, extend: :html5`, permit `\u003cstyle\u003e` elements, and the sanitized output must be rendered to other users. Applications calling `HtmlSanitizeEx.Scrubber.CSS.scrub/1` directly are also affected.","aliases":["CVE-2026-68747","GHSA-87v2-pfhj-r5x7"],"modified":"2026-09-08T16:15:02.414920782Z","published":"2026-08-06T14:50:03.143Z","database_specific":{"cpe_ids":["cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-74"],"capec_ids":["CAPEC-148"]},"references":[{"type":"ADVISORY","url":"https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-87v2-pfhj-r5x7"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-68747.html"},{"type":"FIX","url":"https://github.com/rrrene/html_sanitize_ex/commit/0b9f9ad63a7529d4f2c3c1134c371adc3e654308"},{"type":"FIX","url":"https://github.com/rrrene/html_sanitize_ex/commit/c311a499db0b0baef06493fb3cfeb730c0f18f28"},{"type":"PACKAGE","url":"https://hex.pm/packages/html_sanitize_ex"}],"affected":[{"package":{"name":"html_sanitize_ex","ecosystem":"Hex","purl":"pkg:hex/html_sanitize_ex"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.1"},{"fixed":"1.4.5"}]},{"type":"SEMVER","events":[{"introduced":"1.5.0-rc.0"},{"fixed":"1.5.4"}]}],"versions":["0.3.1","1.0.0","1.0.1","1.1.0","1.1.0-rc1","1.1.1","1.2.0","1.3.0","1.3.0-rc1","1.3.0-rc2","1.3.0-rc3","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.4-rc.0","1.5.0","1.5.0-rc.0","1.5.1","1.5.2","1.5.3"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-68747.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/rrrene/html_sanitize_ex","events":[{"introduced":"21f90012eb21aa36f4e3701b7547e12faf0f3c8b"},{"fixed":"0b9f9ad63a7529d4f2c3c1134c371adc3e654308"},{"fixed":"c311a499db0b0baef06493fb3cfeb730c0f18f28"}]}],"versions":["v1.4.4","v1.5.3","v1.5.2","v1.5.1","v1.5.0","v1.5.0-rc.0","v1.4.3","v1.4.2","v1.4.1","v1.2.0","v1.0.1","v1.0.0","v0.3.1"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-68747.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}],"credits":[{"name":"Peter Ullrich","type":"FINDER"},{"name":"Jonatan Männchen / EEF","type":"ANALYST"},{"name":"René Föhring","type":"REMEDIATION_DEVELOPER"}]}