XSS in Mganss Htmlsanitizer
CVE-2026-116538
HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/mganss/HtmlSanitizer/commit/96afbc818e64de7571ea17954a05d523e819c56f (patch)
- github.com/mganss/HtmlSanitizer/commit/ab626e7a4f2893f7e9ec0a72779ae19c5ec439a7 (patch)
- github.com/mganss/HtmlSanitizer/blob/v9.2.995/src/HtmlSanitizer/HtmlSanitizer.cs (technical-description)
- github.com/mganss/HtmlSanitizer/blob/v9.2.995/src/HtmlSanitizer/HtmlSanitizer.cs (technical-description)
- joshua.hu/htmlsanitizer-sanitizedom-body-html-attribute-bypass (technical-description)
- github.com/mganss/HtmlSanitizer/releases/tag/v9.2.1039 (release-notes)
- github.com/mganss/HtmlSanitizer/releases/tag/v10.0.1037-beta (release-notes)
- github.com/mganss/HtmlSanitizer (product)
- www.vulncheck.com/advisories/htmlsanitizer-before-9.2.1039-xss-via-sanitizedom-… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-116538?
- CVE-2026-116538 is a medium-severity vulnerability in Mganss Htmlsanitizer, classified under Cross-site Scripting. CVSS score: 4.7/10. Published 2026-10-26.
- How severe is CVE-2026-116538?
- Medium severity. CVSS v3 base score is 4.7 out of 10.