TI-2026-80455 Aliases CVE-2026-116538 GHSA-qw8f-hph4-7r4g

Cross-site scripting in HtmlSanitizer via SanitizeDom attributes

LOW 12CWE-79Published 2026-10-26 · Updated 2026-10-31

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting flaw (CWE-79). SanitizeDom(string) never sanitizes attributes on html and body wrapper elements, so a second body or html tag in the input keeps its event handlers. An unauthenticated remote attacker can run script when an application renders the serialized document or body outer HTML, and a user must view that content.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00287 21st percentileScored 2026-11-07

Fix Fixed HtmlSanitizer (mganss): 9.2.1039, 10.0.1037-beta

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
mganss	HtmlSanitizer	before 9.2.1039; 10.0.0-beta to before 10.0.1037-beta	9.2.1039, 10.0.1037-beta	Patch available	CNA

HtmlSanitizer Vendormganss Affected before 9.2.1039; 10.0.0-beta to before 10.0.1037-beta Fixed in 9.2.1039, 10.0.1037-beta Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:htmlsanitizer_project:htmlsanitizer::::::::	—	—	mganss

cpe:2.3:a:htmlsanitizer_project:htmlsanitizer:*:*:*:*:*:*:*:* Versions — — ·mganss

Remediation

Update HtmlSanitizer to version 9.2.1039, or to 10.0.1037-beta for the 10.0 prereleases.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Fix · CNA HtmlSanitizer (mganss) Fixed in 9.2.1039, 10.0.1037-beta

Timeline

2026-10-26 Threatist record created from CVE-2026-116538
2026-10-27 Alias added: GHSA-qw8f-hph4-7r4g
2026-10-31 CISA SSVC decision points changed

References

Patch 2

Other 6

TI-2026-20652 HtmlSanitizer has a bypass via template tag CVSS 4.0MEDIUM 6.3
TI-2020-16114 Possible XSS bypass if style tag is allowed CVSS 3.1MEDIUM 6.1
TI-2023-23896 HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences