Executive brief
html_sanitize_ex is a library used to remove potentially malicious code from HTML content before displaying it to users. An attacker can inject CSS @import rules pointing to attacker-controlled stylesheets, which are then served to other users viewing the sanitized content. While script execution is prevented, this allows an attacker to deface pages or load tracking stylesheets without authorization.
Technical details
The vulnerability is a CSS injection (CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code) in the CSS scrubber component of html_sanitize_ex. The scrubber uses a regex-based allowlist approach that only validates property:value declarations; any CSS text outside this pattern (such as @import rules) passes through unchecked. An unauthenticated remote attacker can inject @import url(//attacker.example/style.css) within <style> tags, causing victim browsers to fetch and apply malicious stylesheets. Element boundaries prevent script injection, limiting impact to CSS-based attacks. Versions 0.3.1–1.4.4 and 1.5.0-rc.0–1.5.3 are affected; patches are available in 1.4.5 and 1.5.4.
Affected products
- rrrene html_sanitize_ex 0.3.1 to 1.4.4, 1.5.0-rc.0 to 1.5.3
Timeline
- 2026-08-06: disclosed