PatchTheCEVCVE-2026-68747: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerabili
31
Routine
MEDIUM 6.1UPGRADE
CVE-2026-68747 is a medium-severity flaw (CVSS 6.1) affecting htmlsanitizeex. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value d
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.1 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.4% (top 62%) |
| CISA exploited list | No |
| Weakness | CWE-74 |
| Published | 2026-08-06 |
| Last modified | 2026-10-23 |
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
rrrene htmlsanitizeex UPGRADE
Affected: >= 0.3.1 and < 1.5.4
Fixed in: 1.5.4
Safe to downgrade to: a release before 0.3.1
1. Check installed version
apt-cache policy htmlsanitizeex || rpm -q htmlsanitizeex || htmlsanitizeex --version
2. UPGRADE to 1.5.4 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade htmlsanitizeex
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade htmlsanitizeex
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 0.3.1 (Debian / Ubuntu)
apt-cache madison htmlsanitizeex
sudo apt install htmlsanitizeex=<VERSION_BEFORE_0.3.1>
sudo apt-mark hold htmlsanitizeex
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list htmlsanitizeex
sudo dnf downgrade htmlsanitizeex-<VERSION_BEFORE_0.3.1>
sudo dnf versionlock add htmlsanitizeex
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-68749 HIGH 7.5 UPGRADE Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows
- CVE-2026-68750 HIGH 7.5 UPGRADE Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an
- CVE-2026-66829 MEDIUM 6.1 UPGRADE URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitiz
- CVE-2026-66843 MEDIUM 6.1 UPGRADE Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sa
- CVE-2026-66370 MEDIUM 6.1 UPGRADE URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitiz