Threats affecting pkg:nuget/HtmlSanitizer

HtmlSanitizer versions before 9.2.1039 and prereleases before 10.0.1037-beta contain a cross-site scripting (XSS) vulnerability. The function SanitizeDom(string) does not sanitize attributes on the html and body wrapper elements, allowing attackers to inject a second html or body tag with event handlers such as onload. This can lead to script execution when the application renders the serialized document or body outer HTML. The vulnerability has a low CVSS score of 2.3 and is fixed in versions 9.2.1039 and 10.0.1037-beta.

CVE-2026-25543 is a medium severity vulnerability in the mganss HtmlSanitizer . NET library, affecting versions prior to 9.0.892 and 9.1.893-beta. The flaw arises from improper encoding or escaping of output (CWE-116) when the HTML template tag is allowed, as its contents are not sanitized unless the shadowrootmode attribute is set. This can lead to cross-site scripting (XSS) attacks if malicious content is injected within template tags. The vulnerability does not require authentication or user interaction and can be exploited remotely over the network. Although no known exploits are currently reported in the wild, the issue has been patched in the specified versions.