What’s Vulnerable › Products

rrrene html_sanitize_ex vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your rrrene html_sanitize_ex version is affected

Latest rrrene html_sanitize_ex vulnerabilities

• CVE-2026-68750 — Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service (CVSS 7.5)
• CVE-2026-68749 — Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service (CVSS 7.5)
• CVE-2026-68747 — CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input (CVSS 6.1)
• CVE-2026-66843 — html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding (CVSS 6.1)
• CVE-2026-66829 — html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection (CVSS 6.1)
• CVE-2026-66370 — html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking (CVSS 6.1)