Read the docs
TI-2026-20652 Aliases CVE-2026-25543GHSA-j92c-7v7g-gj3f

HtmlSanitizer has a bypass via template tag

Priority LOW 34CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. Prior to versions 9.0.892 and 9.1.893-beta, if the template tag is allowed, its contents are not sanitized. The template tag is a special tag that does not usually render its contents, unless the shadowrootmode attribute is set to open or closed. This issue has been patched in versions 9.0.892 and 9.1.893-beta.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00274 19th percentileScored 2026-11-07
Fix Fixed HtmlSanitizer (mganss): 9.0.892, 9.1.893-betaHtmlSanitizer (NuGet): 9.0.892, 9.1.893-beta

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mganssHtmlSanitizerbefore 9.0.892; before 9.1.893-beta9.0.892, 9.1.893-betaPatch availableCNA
—HtmlSanitizer (NuGet)before 9.0.8929.0.892Patch availableGHSA-j92c-7v7g-gj3f
—HtmlSanitizer (NuGet)9.1.878-beta to before 9.1.893-beta9.1.893-betaPatch availableGHSA-j92c-7v7g-gj3f
  • HtmlSanitizer Vendormganss Affected before 9.0.892; before 9.1.893-beta Fixed in 9.0.892, 9.1.893-beta Patch available CNA
  • HtmlSanitizer (NuGet) Vendor— Affected before 9.0.892 Fixed in 9.0.892 Patch available GHSA-j92c-7v7g-gj3f
  • HtmlSanitizer (NuGet) Vendor— Affected 9.1.878-beta to before 9.1.893-beta Fixed in 9.1.893-beta Patch available GHSA-j92c-7v7g-gj3f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:htmlsanitizer_project:htmlsanitizer:*:*:*:*:*:*:*:*before 9.0.892; 9.1.878 to before 9.1.893Vulnerablemganss
  • cpe:2.3:a:htmlsanitizer_project:htmlsanitizer:*:*:*:*:*:*:*:* Versions before 9.0.892; 9.1.878 to before 9.1.893 Vulnerable ·mganss

Remediation

  • Fix · CNA HtmlSanitizer (mganss) Fixed in 9.0.892, 9.1.893-beta
  • Fix · GHSA-j92c-7v7g-gj3f HtmlSanitizer (NuGet) Fixed in 9.0.892 Advisory →
  • Fix · GHSA-j92c-7v7g-gj3f HtmlSanitizer (NuGet) Fixed in 9.1.893-beta Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25543
  2. 2026-10-03 Alias added: GHSA-j92c-7v7g-gj3f

References

Patch 2

Advisory 1

Other 5

  • TI-2020-16114 Possible XSS bypass if style tag is allowed CVSS 3.1MEDIUM 6.1
  • TI-2023-23896 HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences