goauthentik / goauthentik/authentik

Improper Custom CSS Escaping

Open
#18,447 4 comments 3 reactions 2 assignees Claimed by @kensternberg-authentik View on GitHub
bug status/reviewing
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

### Describe the bug

Custom CSS @\import url '&' turned into '\u0026' when injected to DOM style tag

### How to reproduce

1. Update Brand
2. Edit Custom CSS
3. Put something like `@import url('https://fonts.googleapis.com/css2?family=Google+Sans+Flex:opsz,wght@6..144,1..1000&display=swap');`

### Expected behavior

& shouldn't get escaped

### Screenshots

_No response_

### Additional context

_No response_

### Deployment Method

Docker

### Version

2025.8.5

### Relevant log output

```shell

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.