CVE-2026-68749: htmlsanitizeex from 0.3.1 (inclusive), before 1.5.3 (exclusive); +1 more affected products

Affected technology

htmlsanitizeex · from 0.3.1 (inclusive), before 1.5.3 (exclusive)
rrrene

html_sanitize_ex · 0.3.1 to before 1.4.5, 1.5.0-rc.0 to before 1.5.3
rrrene

html_sanitize_ex · 21f90012eb21aa36f4e3701b7547e12faf0f3c8b to before *; status changes: 4f4bd9eb254881462c0461fbab74b29188c2c133 — unaffected, b673df33ddf982c8bd0a8bd6348aa247080b3b14 — unaffected
rrrene

Component: 'Elixir.HtmlSanitizeEx.Scrubber.CSS', 'Elixir.HtmlSanitizeEx'
Function: 'Elixir.HtmlSanitizeEx.Scrubber.CSS':scrub/1, 'Elixir.HtmlSanitizeEx':html5/1
File: lib/html_sanitize_ex/scrubber/css.ex, lib/html_sanitize_ex.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker can exhaust server CPU via a long CSS declaration in sanitized HTML. Source advisory’s CVSS 4.0 assessment (base score 8.2/10) rates confidentiality and integrity impact as none; availability impact as high.