goauthentik / goauthentik/authentik
Improper Custom CSS Escaping
Open
bug
status/reviewing
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
### Describe the bug
Custom CSS @\import url '&' turned into '\u0026' when injected to DOM style tag
### How to reproduce
1. Update Brand
2. Edit Custom CSS
3. Put something like `@import url('https://fonts.googleapis.com/css2?family=Google+Sans+Flex:opsz,wght@6..144,1..1000&display=swap');`
### Expected behavior
& shouldn't get escaped
### Screenshots
_No response_
### Additional context
_No response_
### Deployment Method
Docker
### Version
2025.8.5
### Relevant log output
```shell
```
Contributor guide
Assessment
This issue has not been assessed yet.