Medium severity4.7NVD Advisory· Published Oct 26, 2026· Updated Oct 26, 2026
CVE-2026-116538
CVE-2026-116538
Description
HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.
Affected products
1- Range: <9.2.1039 and <10.0.1037-beta
Patches
Vulnerability mechanics
References
8- github.com/mganss/HtmlSanitizer/blob/v9.2.995/src/HtmlSanitizer/HtmlSanitizer.csnvd
- github.com/mganss/HtmlSanitizer/blob/v9.2.995/src/HtmlSanitizer/HtmlSanitizer.csnvd
- github.com/mganss/HtmlSanitizer/commit/96afbc818e64de7571ea17954a05d523e819c56fnvd
- github.com/mganss/HtmlSanitizer/commit/ab626e7a4f2893f7e9ec0a72779ae19c5ec439a7nvd
- github.com/mganss/HtmlSanitizer/releases/tag/v10.0.1037-betanvd
- github.com/mganss/HtmlSanitizer/releases/tag/v9.2.1039nvd
- joshua.hu/htmlsanitizer-sanitizedom-body-html-attribute-bypassnvd
- www.vulncheck.com/advisories/htmlsanitizer-before-9.2.1039-xss-via-sanitizedom-body-and-html-attributesnvd
News mentions
0No linked articles in our index yet.