HtmlSanitizer vulnerabilities

CVEs whose affected-version data names the HtmlSanitizer package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-116538Medium· 4.7

today

HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply inp…

▾ Sunlitmganss · HtmlSanitizervia CVEORG