PT-2026-6321 · Unknown · Sanitize-Html

Nsysean · Published 2026-02-03 · Updated 2026-02-24 · CVE-2026-25543

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions HtmlSanitizer versions prior to 9.0.892 HtmlSanitizer versions prior to 9.1.893-beta

Description HtmlSanitizer is a .NET library designed to prevent cross-site scripting (XSS) attacks by cleaning HTML fragments and documents. Before versions 9.0.892 and 9.1.893-beta, the library did not sanitize the contents of the template tag when it was permitted. The template tag typically does not render its contents unless the shadowrootmode attribute is set to 'open' or 'closed'.

Recommendations Update to HtmlSanitizer version 9.0.892 or later. Update to HtmlSanitizer version 9.1.893-beta or later.

Exploit

Fix

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-116

CWE-79

Related Identifiers

CVE-2026-25543

GHSA-J92C-7V7G-GJ3F

Affected Products

Sanitize-Html

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25543.json · Exploit
• https://github.com/mganss/HtmlSanitizer/commit/0ac53dca30ddad963f2b243669a5066933d82b81 · Patch
• https://github.com/mganss/HtmlSanitizer/security/advisories/GHSA-j92c-7v7g-gj3f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25543 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25543 · Security Note
• https://osv.dev/vulnerability/GHSA-j92c-7v7g-gj3f · Vendor Advisory
• https://github.com/mganss/HtmlSanitizer/releases/tag/v9.0.892 · Note
• https://github.com/mganss/HtmlSanitizer · Note
• https://reddit.com/r/VulnMatter/comments/1qvcw0u/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://nuget.org/packages/HtmlSanitizer/9.1.893-beta · Note
• https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template · Note
• https://t.me/cveNotify/153067 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1qvczeq/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1qvcq63/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://twitter.com/CVEnew/status/2019182745868726467 · Twitter Post