Skip to content
Rrrene Html Sanitize Ex vulnerabilities
-
rrrene htmlsanitizeex, html sanitize ex +1 more
Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service
CVE-2026-68750
Fix available
8.2 High
-
rrrene htmlsanitizeex, html sanitize ex +1 more
Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service
CVE-2026-68749
Fix available
8.2 High
-
rrrene htmlsanitizeex, html sanitize ex +1 more
CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input
CVE-2026-68747
Fix available
2.3 Low
-
rrrene htmlsanitizeex, html sanitize ex +1 more
html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection
CVE-2026-66829
Fix available
2.3 Low
-
rrrene html sanitize ex, htmlsanitizeex +1 more
html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking
CVE-2026-66370
Fix available
4.8 Medium
-
rrrene html sanitize ex, htmlsanitizeex +1 more
html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding
CVE-2026-66843
Fix available
2.3 Low