103 matches found
sanitize
Sanitize Sanitize is an allowlist-based HTML and CSS sanitizer. It removes all HTML and/or CSS from a string except the elements, attributes, and properties you choose to allow. Using a simple configuration syntax, you can tell Sanitize to allow certain HTML elements, certain attributes within...
Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
Summary Crass's tokenizer didn't terminate a bad URL token at a that followed an escaped backslash \. As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing...
GHSA-PQ4G-8RXF-4G29 Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
Summary Crass's tokenizer didn't terminate a bad URL token at a that followed an escaped backslash \. As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing...
CVE-2026-116695 Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules insi...
CVE-2026-116695 Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules insi...
CVE-2026-116695
The Crass Ruby CSS parser (prior to version 1.0.8 ) is vulnerable to a CSS sanitizer bypass due to incorrect tokenization of bad URLs. The parser treats a closing parenthesis following an escaped backslash as escaped, causing it to retain declarations or style rules within a bad URL token that a ...
CVE-2026-76203
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that...
CVE-2026-76203 CSS sanitizer bypass in Pentestify report themes allows forced outbound requests
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that...
CVE-2026-76203
Pentestify (a penetration testing report tool by maalfer) versions 1.2.0 through 2.3.2 contain a CSS sanitizer bypass in the report theme feature. The root cause is an Incorrect Behavior Order: Validate Before Canonicalize flaw — the sanitizer checks CSS input before resolving hex escape sequence...
CVE-2026-76203
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that...
CVE-2026-76203 CSS sanitizer bypass in Pentestify report themes allows forced outbound requests
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that...
EUVD-2026-62416
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that...
EEF-CVE-2026-68749 Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service
Summary Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the...
CVE-2026-68747
CVE-2026-68747 affects html_sanitize_ex: the CSS Scrubber (Scrubber.CSS.scrub/1) has a non-declaration input bypass in versions prior to 1.5.4 (0.3.1). An attacker can inject CSS at-rules (e.g., @import url(...)) into pages served to other users because the allowlist is applied via a Regex over d...
[SECURITY] [DLA 4517-1] roundcube security update
Debian LTS Advisory DLA-4517-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin March 30, 2026 https://wiki.debian.org/LTS Package : roundcube Version : 1.4.15+dfsg.1-1+deb11u8 CVE ID : not yet available Debian Bug : 1131182 1132268 Multiple vulnerabilities were...
MiracleLinux 4 : firefox-78.6.0-1.0.1.AXS4 (AXSA:2020-1071:28)
The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2020-1071:28 advisory. chromium-browser: Uninitialized Use in V8 CVE-2020-16042 Mozilla: Heap buffer overflow in WebGL CVE-2020-26971 Mozilla: CSS Sanitizer performed...
CVE-2026-22712 ApprovedRevs allows bypassing the inline CSS sanitizer
Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39...
CVE-2026-22712
The CVE-2026-22712 issue affects MediaWiki’s ApprovedRevs extension (versions 1.39–1.45). The root cause is improper encoding or escaping of output due to a magic word replacement in ParserAfterTidy, which can enable input data manipulation by bypassing the inline CSS sanitizer. Exploitation deta...