Vulnerability · Published Feb 4, 2026 · Assigned by GitHub_M
CVE-2026-25543HtmlSanitizer has a bypass via template tag
Medium 6.3
In plain English
A medium-severity security flaw in HtmlSanitizer from mganss. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. Prior to versions 9.0.892 and 9.1.893-beta, if the template tag is allowed, its contents are not sanitized. The template tag is a special tag that does not usually render its contents, unless the shadowrootmode attribute is set to open or closed. This issue has been patched in versions 9.0.892 and 9.1.893-beta.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | htmlsanitizer | 9.0.892 | GHSA-j92c-7v7g-gj3f |
| NuGet | htmlsanitizer | 9.1.893-beta | GHSA-j92c-7v7g-gj3f |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mganss | HtmlSanitizer | < 9.0.892< 9.1.893-beta |
Weakness: CWE-116 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
References
- https://github.com/mganss/HtmlSanitizer/security/advisories/GHSA-j92c-7v7g-gj3f x_refsource_CONFIRM
- https://github.com/mganss/HtmlSanitizer/commit/0ac53dca30ddad963f2b243669a5066933d82b81 x_refsource_MISC
- https://www.nuget.org/packages/HtmlSanitizer/9.0.892 x_refsource_MISC
- https://www.nuget.org/packages/HtmlSanitizer/9.1.893-beta x_refsource_MISC