Threat Intelligence Database

CVE-2026-68750 is an inefficient algorithmic complexity vulnerability in the traversal engine of the rrrene html_sanitize_ex library. It allows an unauthenticated remote attacker to exhaust server CPU and memory by submitting sanitized HTML with a large flat run of sibling elements. The traversal function recursively flattens sibling lists inefficiently, causing quadratic time complexity relative to the number of siblings. This vulnerability affects all public entry points without requiring special configuration or scrubbers. Versions from 0.3.1 up to but not including 1.5.3, including 1.5.0-rc.0, are impacted.

CVE-2026-66843 is a low-severity vulnerability in the html_sanitize_ex library by rrrene. It involves the inclusion of functionality from an untrusted control sphere via the data attribute of an <object> element in sanitized HTML. This allows a remote attacker to load arbitrary documents into a trusted page. However, this is not unconditional cross-site scripting, as javascript: URLs do not execute through <object data> in current browsers, and data: documents load in an opaque origin. Exploitation requires the application to serve attacker-controlled content from a same-origin path.

CVE-2026-68747 is a low severity injection vulnerability in the CSS scrubber of the rrrene html_sanitize_ex library. It allows an unauthenticated remote attacker to inject CSS at-rules, such as importing a remote stylesheet, into pages served to other users. The vulnerability arises because the scrubber applies its allowlist only to property:value patterns, leaving other CSS constructs like @import unfiltered. Injected content remains within the <style> element and does not execute scripts.

CVE-2026-66829 is a low-severity open redirect vulnerability in the html_sanitize_ex library's HTML5 scrubber. It allows remote attackers to cause users to navigate to attacker-chosen sites via a <meta http-equiv="refresh"> element in sanitized HTML output. This is not a cross-site scripting issue, as script execution is not possible through this vector. The vulnerability affects versions from 0.3.1 up to but not including 1.5.3, including 1.5.0-rc.0. No official patch or fix is currently documented.

CVE-2026-66370 is an open redirect vulnerability in the html_sanitize_ex HTML5 scrubber by rrrene. It allows an unauthenticated remote attacker to manipulate form input elements to redirect form submissions to an attacker-controlled external URL. The vulnerability arises because the sanitizer does not validate the scheme of the form and formaction attributes on input elements, allowing cross-origin URLs to persist after sanitization. No script execution is possible, and the attacker cannot inject new forms, only retarget existing forms on the page. This affects versions from 0.3.1 up to but not including 1.5.3, including 1.5.0-rc.0.

Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the tail of a sibling list and then evaluates List.flatten([head] ++ tail) over the already flattened result, so every one of n siblings copies and re-walks the entire remaining tail. The flattening is only needed for the rare case where scrub returns several replacement nodes for one node, but the cost is paid across the whole tail at every step, making traversal quadratic in sibling count. The traverser sits on every public entry point, so no particular scrubber or configuration is required and the payload needs only allowed tags. A 160 KB body of 20,000 sibling elements occupies a scheduler for roughly 1.7 seconds, and the cost grows faster than the body does. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.

Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name with an unbounded greedy [-\w]+ followed by a mandatory :, so a long run of word characters not followed by a colon makes the engine give back one character at a time and retry the colon at every start offset. The work is quadratic in the length of the run, and no length cap is applied to the CSS handed to the scrubber. An 80 KB <style> body costs roughly 2.4 seconds of scheduler time, so a few concurrent requests saturate the BEAM scheduler pool and make the application unresponsive. The impact is CPU exhaustion only. Nothing is read, modified or disclosed. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed. Element boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.4.

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a <meta http-equiv="refresh"> element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied <meta> elements in its output. A meta element acts on the whole document rather than on the fragment it was embedded in, so it can also declare document-wide directives such as Content-Security-Policy. This is not cross-site scripting. Browsers do not navigate a meta refresh to a javascript: URL, so the uppercase JAVASCRIPT: filter bypass yields no script execution and none was demonstrated. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction attributes on an <input> element in sanitized HTML. HTML's form attribute associates an input with any form on the page by its id even when the input sits outside that form, and formaction on a submit control overrides the owning form's action. Neither attribute receives a scheme check, so an absolute cross-origin URL survives sanitizing. No script executes. The scrubber allows neither form nor button, so the attacker cannot introduce a form of their own and the rendering page must already contain a form carrying an id. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.