AIKIDO-2026-634061
html_sanitize_ex is vulnerable to CSS Injection
23
Low Risk
This Affects:
html_sanitize_exTL;DR
The CSS scrubber applies its property and value allowlist only to substrings that match a property: value declaration pattern, so input that does not match that pattern is copied to the output unchanged. This lets CSS at-rules such as @import url(...) survive sanitizing and pull in a remote stylesheet or inject styling into a page shown to other users. The fix inspects and neutralizes at-rules instead of passing unmatched input through.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the HtmlSanitizeEx.html5/1 scrubber, or call HtmlSanitizeEx.Scrubber.CSS.scrub/1 directly, on style element content that is rendered to other users.
Background info
html_sanitize_ex is vulnerable to CSS Injection in versions 0.3.1 - 1.5.3.
How to fix this
Upgrade the html_sanitize_ex library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant