CVE-2026-25543

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. Prior to versions 9.0.892 and 9.1.893-beta, if the template tag is allowed, its contents are not sanitized. The template tag is a special tag that does not usually render its contents, unless the shadowrootmode attribute is set to open or closed. This issue has been patched in versions 9.0.892 and 9.1.893-beta.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-116 CWE-79

Affected software

Vendor	Product	Versions
mganss	HtmlSanitizer	< 9.0.892; < 9.1.893-beta

References

https://github.com/mganss/HtmlSanitizer/commit/0ac53dca30ddad963f2b243669a5066933d82b81Patch
https://github.com/mganss/HtmlSanitizer/security/advisories/GHSA-j92c-7v7g-gj3fMitigation, Patch, Vendor Advisory
https://www.nuget.org/packages/HtmlSanitizer/9.0.892Product, Release Notes
https://www.nuget.org/packages/HtmlSanitizer/9.1.893-betaProduct, Release Notes

Timeline

Published: Feb 4, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-255449.8Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was CVE-2026-255458.6Astro is a web framework. Prior to version 9.5.4, Server-Side Rendered pages that return an error with a prerendered custom error page (eg. CVE-2026-255467.8Godot MCP is a Model Context Protocol (MCP) server for interacting with the Godot game engine. Prior to version 0.1.1, a command injection v CVE-2026-255479.2@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerabl CVE-2026-255489.1InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) v CVE-2026-25557.5A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modul CVE-2026-255509.8Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .NET Remoting service CVE-2026-255517.8Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users CVE-2026-255523.7Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls CVE-2026-255546.5OpenSIPS versions 3.1 before 3.6.4 containing the auth_jwt module (prior to commit 3822d33) contain a SQL injection vulnerability in the jwt CVE-2026-255559.8OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unaut CVE-2026-255567.5MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs duri