GHSA-wgw9-qhqg-8hv5

Unknown

Published: —Translated: 28/10/2026(UTC)NVD NIST

Summary

A vulnerability in the Sanitize library allows bypassing CSS sanitization when <style> elements are allowed, when Sanitize::CSS#stylesheet or Sanitize::CSS#tree! is used to sanitize a stylesheet directly, or when output from Sanitize::CSS#properties is embedded inside a style rule. An attacker can inject malicious CSS, potentially leading to dangerous actions in the user's browser.

Risk Assessment

The organization may be exposed to XSS attacks or other consequences of malicious CSS injection if the application uses Sanitize to filter HTML content with embedded styles. This could lead to session data theft or page defacement for fraud.

Recommendation

Update the Sanitize library to the latest version containing the fix. If updating is not possible, consider disabling support for <style> elements or restricting the use of Sanitize::CSS methods to trusted sources.

Other vulnerabilities in Sanitize

CVE-2023-36823High
Sanitize is an HTML and CSS sanitizer that in versions from 3.0.0 to 6.0.2 may be vulnerable to injection of malicious HTML and CSS. An attacker can exploit carefully crafted input to introduce unauthorized code, potentially leading to cross-site scripting attacks.

Original NVD description (English source)

## SUMMARY When Sanitize is configured to allow <style> elements, when Sanitize::CSS#stylesheet or Sanitize::CSS#tree! is used to sanitize a stylesheet directly, or when the output of Sanitize::CSS#properties is embedded inside a style rule in a stylesheet, an attacker can bypass Sanitize's CSS pro

Vulnerability data from NVD (NIST) · CISA KEV · EPSS