html_sanitize_ex (Hex)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 1.5.4 or later clears every advisory below that has a fix.

Upgrade commands

mix

{:html_sanitize_ex, "~> 1.5.4"} # then: mix deps.update html_sanitize_ex

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
EEF-CVE-2026-68750 Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service	High EPSS 0.80%	`>= 0.3.1, < 1.4.5` `>= 1.5.0-rc.0, < 1.5.3`	`1.4.5` `1.5.3`
EEF-CVE-2026-68749 Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service	High EPSS 0.80%	`>= 0.3.1, < 1.4.5` `>= 1.5.0-rc.0, < 1.5.3`	`1.4.5` `1.5.3`
EEF-CVE-2026-68747 CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input	Medium EPSS 0.45%	`>= 0.3.1, < 1.4.5` `>= 1.5.0-rc.0, < 1.5.4`	`1.4.5` `1.5.4`
EEF-CVE-2026-66829 html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection	Medium EPSS 0.57%	`>= 0.3.1, < 1.4.5` `>= 1.5.0-rc.0, < 1.5.3`	`1.4.5` `1.5.3`
EEF-CVE-2026-66370 html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking	Medium EPSS 0.40%	`>= 0.3.1, < 1.4.5` `>= 1.5.0-rc.0, < 1.5.3`	`1.4.5` `1.5.3`
EEF-CVE-2026-66843 html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding	Medium EPSS 0.51%	`>= 0.3.1, < 1.4.5` `>= 1.5.0-rc.0, < 1.5.3`	`1.4.5` `1.5.3`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor