Cross-Site Scripting Vulnerability in AngleSharp Library by AngleSharp
CVE-2026-54570

6.9MEDIUM

Key Information:

Vendor

Anglesharp

Status
Anglesharp
Vendor
CVE Published:
18 August 2026

What is CVE-2026-54570?

The AngleSharp library prior to version 1.5.0 contains a vulnerability that allows an attacker to exploit differences in namespace handling and markup configurations. Specifically, the MathAnnotationXmlElement is not correctly recognized as an integration point for HTML when the encoding attributes are set to text/html or application/xhtml+xml. This misrouting allows tokens to be parsed through foreign-content parsing, which can lead to a scenario where a sanitizer sees a different Document Object Model (DOM) than the browser. Consequently, attackers can inject malicious scripts into web applications, leading to potential cross-site scripting (XSS) attacks. This issue has been addressed in the library's latest version, 1.5.0.

Affected Version(s)

AngleSharp < 1.5.0

References

https://github.com/AngleSharp/AngleSharp/security/advisor...
x_refsource_CONFIRM
https://github.com/AngleSharp/AngleSharp/commit/8033a5c69...
x_refsource_MISC
https://github.com/AngleSharp/AngleSharp/releases/tag/1.5.0
x_refsource_MISC

CVSS V3.1

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.