Read the docs
TI-2023-23896 Aliases CVE-2023-44390GHSA-43cp-6p3q-2pc4

HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability occurs in configurations where foreign content is allowed, i.e. either `svg` or `math` are in the list of allowed elements. In the case an application sanitizes user input with a vulnerable configuration, an attacker could bypass the sanitization and inject arbitrary HTML, including JavaScript code. Note that in the default configuration the vulnerability is not present. The vulnerability has been fixed in versions 8.0.723 and 8.1.722-beta (preview version).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00416 36th percentileScored 2026-11-07
Fix Fixed HtmlSanitizer (mganss): 8.0.723, 8.1.722-betaHtmlSanitizer (NuGet): 8.0.723, 8.1.722-beta

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mganssHtmlSanitizerbefore 8.0.723; 8.1.0-beta to before 8.1.722-beta8.0.723, 8.1.722-betaPatch availableCNA
—HtmlSanitizer (NuGet)before 8.0.7238.0.723Patch availableGHSA-43cp-6p3q-2pc4
—HtmlSanitizer (NuGet)8.1.0-beta to before 8.1.722-beta8.1.722-betaPatch availableGHSA-43cp-6p3q-2pc4
  • HtmlSanitizer Vendormganss Affected before 8.0.723; 8.1.0-beta to before 8.1.722-beta Fixed in 8.0.723, 8.1.722-beta Patch available CNA
  • HtmlSanitizer (NuGet) Vendor— Affected before 8.0.723 Fixed in 8.0.723 Patch available GHSA-43cp-6p3q-2pc4
  • HtmlSanitizer (NuGet) Vendor— Affected 8.1.0-beta to before 8.1.722-beta Fixed in 8.1.722-beta Patch available GHSA-43cp-6p3q-2pc4

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:htmlsanitizer_project:htmlsanitizer:*:*:*:*:*:*:*:*before 8.0.723Vulnerablemganss
cpe:2.3:a:htmlsanitizer_project:htmlsanitizer:8.1.719:beta:*:*:*:*:*:*8.1.719 betaVulnerablemganss
  • cpe:2.3:a:htmlsanitizer_project:htmlsanitizer:*:*:*:*:*:*:*:* Versions before 8.0.723 Vulnerable ·mganss
  • cpe:2.3:a:htmlsanitizer_project:htmlsanitizer:8.1.719:beta:*:*:*:*:*:* Versions 8.1.719 beta Vulnerable ·mganss

Remediation

  • Fix · CNA HtmlSanitizer (mganss) Fixed in 8.0.723, 8.1.722-beta
  • Fix · GHSA-43cp-6p3q-2pc4 HtmlSanitizer (NuGet) Fixed in 8.0.723 Advisory →
  • Fix · GHSA-43cp-6p3q-2pc4 HtmlSanitizer (NuGet) Fixed in 8.1.722-beta Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-44390
  2. 2026-10-03 Alias added: GHSA-43cp-6p3q-2pc4

References

Patch 1

Advisory 2

Other 1

  • TI-2026-20652 HtmlSanitizer has a bypass via template tag CVSS 4.0MEDIUM 6.3
  • TI-2020-16114 Possible XSS bypass if style tag is allowed CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences