Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: rrrene Component: Htmlsanitizeex Clear all filters
TI-2026-48335 CVE-2026-68750 · GHSA-684p-mhw3-3cwq

Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service

Priority LOW 37

Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitiz…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00802 Published 2026-08-06 Fixed in 1.4.5, 1.5.3 CWE-407
TI-2026-48334 CVE-2026-68749 · GHSA-8rjf-8hw9-j63g

Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service

Priority LOW 37

Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00802 Published 2026-08-06 Fixed in 1.4.5, 1.5.3 CWE-1333
TI-2026-48333 CVE-2026-68747 · GHSA-g72r-5wgp-6532

CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

Priority LOW 12

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-r…

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00448 Published 2026-08-06 Fixed in 1.4.5, 1.5.4 CWE-74
TI-2026-47457 CVE-2026-66829 · GHSA-c486-5fvq-fp3v

html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection

Priority LOW 13

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via…

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00566 Published 2026-08-06 Fixed in 1.4.5, 1.5.3 CWE-601
TI-2026-47137 CVE-2026-66370 · GHSA-r8xc-fmjg-37c5

html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking

Priority LOW 22

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive wh…

CVSS 4.0MEDIUM 4.8 Network No auth User interaction EPSS 0.00403 Published 2026-08-06 Fixed in 1.4.5, 1.5.3 CWE-601
TI-2026-47464 CVE-2026-66843 · GHSA-6g7x-33rf-28v3

html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding

Priority LOW 13

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attri…

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00512 Published 2026-08-06 Fixed in 1.4.5, 1.5.3 CWE-829