{"id":"CVE-2026-116538","title":"HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes","summary":"HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply inp…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"mganss","product":"HtmlSanitizer","affected":["HtmlSanitizer < 9.2.1039","HtmlSanitizer >= 10.0.0-beta < 10.0.1037-beta"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T14:59:38.815Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116538","references":[{"url":"https://github.com/mganss/HtmlSanitizer/commit/96afbc818e64de7571ea17954a05d523e819c56f","label":"Patch Commit"},{"url":"https://github.com/mganss/HtmlSanitizer/commit/ab626e7a4f2893f7e9ec0a72779ae19c5ec439a7"},{"url":"https://github.com/mganss/HtmlSanitizer/blob/v9.2.995/src/HtmlSanitizer/HtmlSanitizer.cs#L456-L465"},{"url":"https://github.com/mganss/HtmlSanitizer/blob/v9.2.995/src/HtmlSanitizer/HtmlSanitizer.cs#L555-L583"},{"url":"https://joshua.hu/htmlsanitizer-sanitizedom-body-html-attribute-bypass"},{"url":"https://github.com/mganss/HtmlSanitizer/releases/tag/v9.2.1039","label":"HtmlSanitizer v9.2.1039 Release Notes"},{"url":"https://github.com/mganss/HtmlSanitizer/releases/tag/v10.0.1037-beta","label":"HtmlSanitizer v10.0.1037-beta Release Notes"},{"url":"https://github.com/mganss/HtmlSanitizer"},{"url":"https://www.vulncheck.com/advisories/htmlsanitizer-before-9.2.1039-xss-via-sanitizedom-body-and-html-attributes","label":"VulnCheck Advisory: HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T15:29:30.503Z","slug":"CVE-2026-116538","body":"## Overview\n\nHtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.\n\n## Affected\n\n- `HtmlSanitizer < 9.2.1039`\n- `HtmlSanitizer >= 10.0.0-beta < 10.0.1037-beta`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}