What’s Vulnerable › Vulnerabilities

CVE-2026-25543: HtmlSanitizer has a bypass via template tag

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-04 · updated 2026-06-17
• Weakness: CWE-116

Description

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. Prior to versions 9.0.892 and 9.1.893-beta, if the template tag is allowed, its contents are not sanitized. The template tag is a special tag that does not usually render its contents, unless the shadowrootmode attribute is set to open or closed. This issue has been patched in versions 9.0.892 and 9.1.893-beta.

Affected products

• mganss HtmlSanitizer: before 9.0.892; from 9.1.878 before 9.1.893 — fixed in 9.0.892, 9.1.893

How to fix

Upgrade to a fixed version: mganss HtmlSanitizer 9.0.892, 9.1.893. Check the vendor advisory for mitigations.

References

• https://github.com/mganss/HtmlSanitizer/commit/0ac53dca30ddad963f2b243669a5066933d82b81
• https://github.com/mganss/HtmlSanitizer/security/advisories/GHSA-j92c-7v7g-gj3f
• https://www.nuget.org/packages/HtmlSanitizer/9.0.892
• https://www.nuget.org/packages/HtmlSanitizer/9.1.893-beta

Get alerted when CVE-2026-25543 or the next vulnerability affects your stack