Interpretation Conflict in sanitize - #VU159534
Published: November 6, 2026 / Updated: November 6, 2026
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to bypass Sanitize's CSS property and URL protocol allowlists, enabling arbitrary styling, UI redressing, blocked resource loads, and potential exfiltration of page data such as form input values, but not script execution.
The vulnerability exists due to interpretation conflicts between Sanitize's stylesheet parser and browsers implementing CSS nesting when style elements are allowed, stylesheets are sanitized directly through Sanitize::CSS#stylesheet or Sanitize::CSS#tree!, or Sanitize::CSS#properties output is embedded in a stylesheet rule: a block inside an allowlisted property's value is preserved without inspecting its contents although browsers reparse it as a nested style rule, while declarations inside an allowed style-containing at-rule nested within a style rule are misinterpreted as an unsanitized selector although browsers apply them as declarations to the parent rule. An unauthenticated remote attacker can supply crafted CSS using either an allowlisted property containing a nested block or an allowed nested at-rule such as @media, @supports, or @container with declarations followed by an empty style rule, control which elements receive the smuggled declarations, and cause a victim merely viewing the page to encounter misleading overlays or make resource requests that can exfiltrate data through attribute selectors; CSS used in style attributes is unaffected, the built-in DEFAULT, RESTRICTED, and BASIC configurations do not allow style elements, and the affected RELAXED configuration provides little additional attacker capability because it already permits nearly all properties and HTTP and HTTPS URLs, making custom configurations with tighter property or protocol restrictions the principal exposure.