PT-2026-6321 · Unknown · Sanitize-Html

Nsysean · Publicado 2026-02-03 · Atualizado 2026-02-24 · CVE-2026-25543

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions HtmlSanitizer versions prior to 9.0.892 HtmlSanitizer versions prior to 9.1.893-beta

Description HtmlSanitizer is a .NET library designed to prevent cross-site scripting (XSS) attacks by cleaning HTML fragments and documents. Before versions 9.0.892 and 9.1.893-beta, the library did not sanitize the contents of the template tag when it was permitted. The template tag typically does not render its contents unless the shadowrootmode attribute is set to 'open' or 'closed'.

Recommendations Update to HtmlSanitizer version 9.0.892 or later. Update to HtmlSanitizer version 9.1.893-beta or later.

Exploit

Correção

Improper Encoding or Escaping of Output

XSS

Enumeração de Fraquezas

CWE-116

CWE-79

Identificadores relacionados

CVE-2026-25543

GHSA-J92C-7V7G-GJ3F

Produtos afetados

Sanitize-Html

Referências · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25543.json · Exploit
• https://github.com/mganss/HtmlSanitizer/commit/0ac53dca30ddad963f2b243669a5066933d82b81 · Correção
• https://github.com/mganss/HtmlSanitizer/security/advisories/GHSA-j92c-7v7g-gj3f · Aviso do Fabricante
• https://github.com/mganss/HtmlSanitizer/releases/tag/v9.0.892 · Nota
• https://github.com/mganss/HtmlSanitizer · Nota
• https://reddit.com/r/VulnMatter/comments/1qvcw0u/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit
• https://osv.dev/vulnerability/CVE-2026-25543 · Aviso do Fabricante
• https://nuget.org/packages/HtmlSanitizer/9.1.893-beta · Nota
• https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template · Nota
• https://t.me/cveNotify/153067 · Publicação no Telegram
• https://reddit.com/r/VulnMatter/comments/1qvczeq/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2026-25543 · Nota de Segurança
• https://reddit.com/r/VulnMatter/comments/1qvcq63/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit
• https://twitter.com/CVEnew/status/2019182745868726467 · Publicação no Twitter
• https://reddit.com/r/VulnMatter/comments/1qvcre0/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit