Read the docs
TI-2020-16114 Aliases CVE-2020-26293GHSA-8j9v-h2vp-2hhv

Possible XSS bypass if style tag is allowed

Priority LOW 29CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the `<style>` tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the `<style>` tag so there is no risk if you have not explicitly allowed the `<style>` tag. The problem has been fixed in version 5.0.372.

Why it matters now

EPSS 0.0101 63rd percentileScored 2026-11-07
Fix Fixed HtmlSanitizer (mganss): 5.0.372HtmlSanitizer (NuGet): 5.0.372

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
mganssHtmlSanitizerbefore 5.0.3725.0.372Patch availableCNA
—HtmlSanitizer (NuGet)before 5.0.3725.0.372Patch availableGHSA-8j9v-h2vp-2hhv
  • HtmlSanitizer Vendormganss Affected before 5.0.372 Fixed in 5.0.372 Patch available CNA
  • HtmlSanitizer (NuGet) Vendor— Affected before 5.0.372 Fixed in 5.0.372 Patch available GHSA-8j9v-h2vp-2hhv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:htmlsanitizer_project:htmlsanitizer:*:*:*:*:*:*:*:*before 5.0.372Vulnerablemganss
  • cpe:2.3:a:htmlsanitizer_project:htmlsanitizer:*:*:*:*:*:*:*:* Versions before 5.0.372 Vulnerable ·mganss

Remediation

  • Fix · CNA HtmlSanitizer (mganss) Fixed in 5.0.372
  • Fix · GHSA-8j9v-h2vp-2hhv HtmlSanitizer (NuGet) Fixed in 5.0.372 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26293
  2. 2026-10-03 Alias added: GHSA-8j9v-h2vp-2hhv

References

Patch 1

Advisory 4

Other 1

  • TI-2026-20652 HtmlSanitizer has a bypass via template tag CVSS 4.0MEDIUM 6.3
  • TI-2023-23896 HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences