---
id: CVE-2026-54570
title: AngleSharp is a .NET library for parsing angle bracket based hyper-texts
summary: >-
  AngleSharp is a .NET library for parsing angle bracket based hyper-texts.
  Prior to 1.5.0, MathAnnotationXmlElement in
  AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as
  an HTML integration point when its encodin…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N'
cwe:
  - CWE-80
vendor: AngleSharp
product: AngleSharp
affected:
  - AngleSharp < 1.5.0
patched:
  - AngleSharp 1.5.0
published: '2026-08-18'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54570'
references:
  - url: >-
      https://github.com/AngleSharp/AngleSharp/commit/8033a5c690af9c2c443f58e34875343fa4cc1d07
    label: security-advisories@github.com
  - url: 'https://github.com/AngleSharp/AngleSharp/releases/tag/1.5.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg
    label: security-advisories@github.com
  - url: >-
      https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-pgww-w46g-26qg'
tags:
  - nvd
  - ghsa
  - nuget
epss: 0.0031
epssPercentile: 0.24036
aliases:
  - GHSA-pgww-w46g-26qg
ecosystem: nuget
ingestedAt: '2026-07-17T22:16:59.738Z'
---

## Overview

AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing Consume in AngleSharp/Html/Parser/HtmlDomBuilder.cs to route tokens through foreign-content parsing instead of HTML parsing. A sanitizer can therefore observe a different DOM from the browser that reparses the serialized output. An attacker can combine this namespace differential with markup-breaking characters in an attribute value so that an element hidden from the sanitizer becomes active script-capable HTML after browser reparse, resulting in mutation cross-site scripting. This issue is fixed in version 1.5.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54570)

Affected packages:

- `AngleSharp < 1.5.0`

Patched in:

- `AngleSharp 1.5.0`

Source: https://github.com/advisories/GHSA-pgww-w46g-26qg