rrrene vulnerabilities

Products

• html sanitize ex 6
• htmlsanitizeex 6

Latest rrrene CVEs

Newest publication first

1. CVE-2026-68750 Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service

   Published 2026-08-06

   High·CVSS 8.2 EPSS 0.80%

   Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.travers...

2. CVE-2026-68749 Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service

   Published 2026-08-06

   High·CVSS 8.2 EPSS 0.80%

   Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matche...

3. CVE-2026-68747 CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

   Published 2026-08-06

   Low·CVSS 2.3 EPSS 0.45%

   Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a pag...

4. CVE-2026-66829 html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection

   Published 2026-08-06

   Low·CVSS 2.3 EPSS 0.57%

   URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a <meta http-equiv="refresh"> element in sanitized HTML. Ht...

5. CVE-2026-66370 html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking

   Published 2026-08-06

   Medium·CVSS 4.8 EPSS 0.40%

   URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the fo...

6. CVE-2026-66843 html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding

   Published 2026-08-06

   Low·CVSS 2.3 EPSS 0.51%

   Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitized HTML. object is the...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.