Medium 4.7Published Oct 26, 2026

CVE-2026-116538HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes

Updated under an hour ago (Oct 29, 2026, 8:40 PM ET)

Does this affect you?

It affects mganss HtmlSanitizer. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for mganss HtmlSanitizer Exploited in the last 30 days

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.

CVSS: 4.7 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Awaiting Analysis
Record last updated: Oct 26, 2026
First seen by InfoSec Signals: Oct 26, 2026

Affected products

Affected products

mganss HtmlSanitizer mganss:htmlsanitizer (from the name)	before 9.2.1039; from 10.0.0-beta before 10.0.1037-beta	CNA record

References

References

https://github.com/mganss/HtmlSanitizer/commit/96afbc818e64de7571ea17954a05d523e819c56f	patch
https://github.com/mganss/HtmlSanitizer/commit/ab626e7a4f2893f7e9ec0a72779ae19c5ec439a7	patch
https://github.com/mganss/HtmlSanitizer/blob/v9.2.995/src/HtmlSanitizer/HtmlSanitizer.cs#L456-L465	technical-description
https://github.com/mganss/HtmlSanitizer/blob/v9.2.995/src/HtmlSanitizer/HtmlSanitizer.cs#L555-L583	technical-description
https://joshua.hu/htmlsanitizer-sanitizedom-body-html-attribute-bypass	technical-description
https://github.com/mganss/HtmlSanitizer/releases/tag/v9.2.1039	release-notes
https://github.com/mganss/HtmlSanitizer/releases/tag/v10.0.1037-beta	release-notes
https://github.com/mganss/HtmlSanitizer	product
https://www.vulncheck.com/advisories/htmlsanitizer-before-9.2.1039-xss-via-sanitizedom-body-and-html-attributes	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.