CVE-2026-68747

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed. Element boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.4.

• CWE-74

• https://cna.erlef.org/cves/CVE-2026-68747.htmlPatch, Third Party Advisory
• https://github.com/rrrene/html_sanitize_ex/commit/0b9f9ad63a7529d4f2c3c1134c371adc3e654308Patch
• https://github.com/rrrene/html_sanitize_ex/commit/c311a499db0b0baef06493fb3cfeb730c0f18f28
• https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-87v2-pfhj-r5x7Broken Link
• https://osv.dev/vulnerability/EEF-CVE-2026-68747Patch, Third Party Advisory

Published

Aug 6, 2026

Last Modified

Aug 19, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6874A vulnerability was determined in ericc-ch copilot-api up to…4.3
• CVE-2026-68742A flaw was found in SSSD. The sss_nss_protocol_parse_addr() …5.5
• CVE-2026-68743A flaw was found in SSSD. The extract_authtok_v1() function …7.1
• CVE-2026-68744A flaw was found in SSSD. The sss_nss_protocol_fill_initgr()…3.3
• CVE-2026-68745Certificate validation failures in SAML authentication in Ap…8.1
• CVE-2026-68746Not Failing Securely ('Failing Open') vulnerability in liveb…8.8
• CVE-2026-68749Inefficient Regular Expression Complexity vulnerability in t…7.5
• CVE-2026-6875ServiceNow has addressed a remote code execution vulnerabili…9.5
• CVE-2026-68750Inefficient Algorithmic Complexity vulnerability in the trav…7.5
• CVE-2026-68752A Project Resource Manager may gain broader administrative p…7.2
• CVE-2026-68753An unauthenticated user may access restricted Artifactory co…5.3
• CVE-2026-68754A repository publisher without delete permission may modify …6.5