CVE-2026-68750: htmlsanitizeex from 0.3.1 (inclusive), before 1.5.3 (exclusive); +1 more affected products

Affected technology

htmlsanitizeex · from 0.3.1 (inclusive), before 1.5.3 (exclusive)
rrrene

html_sanitize_ex · 0.3.1 to before 1.4.5, 1.5.0-rc.0 to before 1.5.3
rrrene

html_sanitize_ex · 69ea11d61525c470b39b6860d024770d5573ff1f to before *; status changes: 9f5ccedbed230930813f992a1e6906fcf485981e — unaffected, 507a6fb95dd4c466cac8a8355d8989043e9fbcc1 — unaffected
rrrene

Component: 'Elixir.HtmlSanitizeEx.Traverser', 'Elixir.HtmlSanitizeEx'
Function: 'Elixir.HtmlSanitizeEx.Traverser':traverse/2, 'Elixir.HtmlSanitizeEx':basic_html/1, 'Elixir.HtmlSanitizeEx':html5/1, 'Elixir.HtmlSanitizeEx':markdown_html/1, 'Elixir.HtmlSanitizeEx':strip_tags/1
File: lib/html_sanitize_ex/traverser.ex, lib/html_sanitize_ex.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker can exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. Source advisory’s CVSS 4.0 assessment (base score 8.2/10) rates confidentiality and integrity impact as none; availability impact as high.