The vulnerability in rrrene html_sanitize_ex's CSS scrubber (html_sanitize_ex.Scrubber.CSS.scrub/1) stems from improper neutralization of special elements in output used by downstream components. The scrubber uses a Regex.replace to filter CSS property:value declarations but does not inspect input that does not match this pattern, allowing injection of CSS at-rules such as '@import url(//attacker.example/style.css);'. This injected CSS is included in pages served to other users. Element boundaries are resolved before sanitization, preventing script execution or escaping the <style> element. The affected versions are from 0.3.1 up to but not including 1.4.5, and from 1.5.0-rc.0 up to but not including 1.5.4.

An unauthenticated remote attacker can inject CSS at-rules into pages served to other users, potentially causing unintended styling or loading of remote stylesheets. However, the injected content cannot escape the <style> element and does not allow script execution, limiting the impact to CSS injection without direct code execution or cross-site scripting.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the vendor's advisories for updates or patches addressing this issue. Until a fix is available, consider additional filtering or sanitization of CSS at-rules in user input to prevent injection of remote stylesheets.