XSS Vulnerability in HtmlSanitizer Library by Mganss
CVE-2026-25543

6.3MEDIUM

Key Information:

Vendor

Mganss

Status
Htmlsanitizer
Vendor
CVE Published:
4 February 2026

What is CVE-2026-25543?

The HtmlSanitizer library, a .NET tool designed for cleaning HTML fragments and documents, has a vulnerability that allows for potential XSS attacks if the template tag is permitted without proper sanitization. Prior to versions 9.0.892 and 9.1.893-beta, the contents of the template tag were not sanitized, creating a risk when the shadowrootmode attribute was set to open or closed. Users are strongly encouraged to upgrade to the patched versions to secure their applications.

Affected Version(s)

HtmlSanitizer < 9.0.892 < 9.0.892

HtmlSanitizer < 9.1.893-beta < 9.1.893-beta

References

https://github.com/mganss/HtmlSanitizer/security/advisori...
x_refsource_CONFIRM
https://github.com/mganss/HtmlSanitizer/commit/0ac53dca30...
x_refsource_MISC
https://www.nuget.org/packages/HtmlSanitizer/9.0.892
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.