Answer in brief
CVE-2026-68747 records a Low severity (CVSS 2.3) vulnerability in CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input. The current sources do not mark it as known exploited. The current feed maps rrrene/html_sanitize_ex (generic), rrrene/html_sanitize_ex (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 2.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps rrrene/html_sanitize_ex (generic), rrrene/html_sanitize_ex (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| rrrene/html_sanitize_exgeneric | >=0.3.1 <1.5.4 | 1.5.4 |
| rrrene/html_sanitize_exgeneric | >=21f90012eb21aa36f4e3701b7547e12faf0f3c8b <0b9f9ad63a7529d4f2c3c1134c371adc3e654308 | 0b9f9ad63a7529d4f2c3c1134c371adc3e654308 |
Published upstream
Aug 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 6, 2026
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed. Element boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes. This issue affects html_sanitize_ex: from 0.3.1 before 1.5.4.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-68747 records a Low severity (CVSS 2.3) vulnerability in CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input. The current sources do not mark it as known exploited. The current feed maps rrrene/html_sanitize_ex (generic), rrrene/html_sanitize_ex (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 2.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps rrrene/html_sanitize_ex (generic), rrrene/html_sanitize_ex (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| rrrene/html_sanitize_exgeneric | >=0.3.1 <1.5.4 | 1.5.4 |
| rrrene/html_sanitize_exgeneric | >=21f90012eb21aa36f4e3701b7547e12faf0f3c8b <0b9f9ad63a7529d4f2c3c1134c371adc3e654308 | 0b9f9ad63a7529d4f2c3c1134c371adc3e654308 |
Published upstream
Aug 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 6, 2026
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed. Element boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes. This issue affects html_sanitize_ex: from 0.3.1 before 1.5.4.
Quoted source text, attributed separately from HOL analysis.