The vulnerability in rrrene html_sanitize_ex's CSS scrubber (html_sanitize_ex.Scrubber.CSS.scrub/1) stems from improper neutralization of special elements in output used by downstream components, classified as CWE-74. The scrubber applies a property and value allowlist using Regex.replace only on substrings matching property:value declarations, ignoring other CSS constructs. This allows injection of CSS at-rules such as '@import url(//attacker.example/style.css);' which bypass filtering and are included in sanitized output. Element boundaries are resolved before sanitization, preventing injected content from escaping the <style> tag or executing scripts. This affects versions from 0.3.1 before 1.5.4.

An attacker can inject CSS at-rules into pages served to other users, potentially causing unintended styling or loading of remote stylesheets. However, the injected content cannot escape the <style> element nor execute scripts, limiting the impact to CSS injection without direct script execution or code injection. The CVSS 4.0 base score is 2.3, indicating low severity.

No official patch or remediation level is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should be cautious when using affected versions and consider additional filtering or sanitization measures to block CSS at-rules such as '@import'.