CVE-2026-116538

MEDIUM 4.7

HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes

CVSS Score

4.7

EPSS Score

0.0%

EPSS Percentile

0th

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.

CWE	CWE-79
Vendor	mganss
Product	htmlsanitizer
Published	Oct 26, 2026

Stay Ahead of the Next One

Get instant alerts for mganss htmlsanitizer

Be the first to know when new medium vulnerabilities affecting mganss htmlsanitizer are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

mganss / HtmlSanitizer

0 < 9.2.1039 10.0.0-beta < 10.0.1037-beta

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/mganss/HtmlSanitizer/commit/96afbc818e64de7571ea17954a05d523e819c56f github.com: https://github.com/mganss/HtmlSanitizer/commit/ab626e7a4f2893f7e9ec0a72779ae19c5ec439a7 github.com: https://github.com/mganss/HtmlSanitizer/blob/v9.2.995/src/HtmlSanitizer/HtmlSanitizer.cs#L456-L465 github.com: https://github.com/mganss/HtmlSanitizer/blob/v9.2.995/src/HtmlSanitizer/HtmlSanitizer.cs#L555-L583 joshua.hu: https://joshua.hu/htmlsanitizer-sanitizedom-body-html-attribute-bypass github.com: https://github.com/mganss/HtmlSanitizer/releases/tag/v9.2.1039 github.com: https://github.com/mganss/HtmlSanitizer/releases/tag/v10.0.1037-beta github.com: https://github.com/mganss/HtmlSanitizer vulncheck.com: https://www.vulncheck.com/advisories/htmlsanitizer-before-9.2.1039-xss-via-sanitizedom-body-and-html-attributes

Credits

Joshua Rogers