Threats tagged 'ghsa-g72r-5wgp-6532'

CVE-2026-68747 is a low severity injection vulnerability in the CSS scrubber of the rrrene html_sanitize_ex library. It allows an unauthenticated remote attacker to inject CSS at-rules, such as importing a remote stylesheet, into pages served to other users. The vulnerability arises because the scrubber applies its allowlist only to property:value patterns, leaving other CSS constructs like @import unfiltered. Injected content remains within the <style> element and does not execute scripts.