Skip to content
OpenAdvisories

Package · Hex

html_sanitize_ex

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 2.3
    CVE-2026-68747

    CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote s…

    rrrene html_sanitize_ex html_sanitize_ex Hex
  • Low 2.3
    CVE-2026-66829

    html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a <meta http-equiv="refresh"> element …

    rrrene html_sanitize_ex html_sanitize_ex Hex
  • Low 2.3
    CVE-2026-66843

    html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding

    Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitize…

    rrrene html_sanitize_ex html_sanitize_ex Hex