CVE-2026-68747: htmlsanitizeex from 0.3.1 (inclusive), before 1.5.4 (exclusive); +1 more affected products

Affected technology

htmlsanitizeex · from 0.3.1 (inclusive), before 1.5.4 (exclusive)
rrrene

html_sanitize_ex · 0.3.1 to before 1.4.5, 1.5.0-rc.0 to before 1.5.4
rrrene

html_sanitize_ex · 21f90012eb21aa36f4e3701b7547e12faf0f3c8b to before *; status changes: 0b9f9ad63a7529d4f2c3c1134c371adc3e654308 — unaffected, c311a499db0b0baef06493fb3cfeb730c0f18f28 — unaffected
rrrene

Component: 'Elixir.HtmlSanitizeEx.Scrubber.CSS', 'Elixir.HtmlSanitizeEx'
Function: 'Elixir.HtmlSanitizeEx.Scrubber.CSS':scrub/1, 'Elixir.HtmlSanitizeEx':html5/1
File: lib/html_sanitize_ex/scrubber/css.ex, lib/html_sanitize_ex.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

An unauthenticated remote attacker can inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. Source advisory’s CVSS 4.0 assessment (base score 2.3/10) rates confidentiality, integrity and availability impact as none.