https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 16:10:13 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-355315 EUVD-2026-355315 https://cve.radiocsirt.org/vuln/euvd-2026-355315 https://cve.radiocsirt.org/vuln/fkie_cve-2026-68747 <p>Improper Neutralization of Special Elements in Output Used by a Downstream Component (&#39;Injection&#39;) vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed.</p> <p>Element boundaries are resolved before the scrubber runs, so injected content does not escape the &lt;style&gt; element and no script executes.</p> <p>This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.4.</p> <p>Improper Neutralization of Special Elements in Output Used by a Downstream Component (&#39;Injection&#39;) vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed.</p> <p>Element boundaries are resolved before the scrubber runs, so injected content does not escape the &lt;style&gt; element and no script executes.</p> <p>This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-68747 https://cve.radiocsirt.org/vuln/ghsa-g72r-5wgp-6532 <p>Improper Neutralization of Special Elements in Output Used by a Downstream Component (&#39;Injection&#39;) vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed.</p> <p>Element boundaries are resolved before the scrubber runs, so injected content does not escape the &lt;style&gt; element and no script executes.</p> <p>This issue affects html_sanitize_ex: from 0.3.1 before 1.5.4.</p> <p>Improper Neutralization of Special Elements in Output Used by a Downstream Component (&#39;Injection&#39;) vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed.</p> <p>Element boundaries are resolved before the scrubber runs, so injected content does not escape the &lt;style&gt; element and no script executes.</p> <p>This issue affects html_sanitize_ex: from 0.3.1 before 1.5.4.</p> https://cve.radiocsirt.org/vuln/ghsa-g72r-5wgp-6532