Live › vulnerability › CVE-2026-116538
Go to dashboardHtmlSanitizer's SanitizeDom(string) method does not sanitize attributes on the html and body wrapper elements. An attacker can supply input with a second body or html tag carrying event handlers such as onload, which runs script when the application renders the serialized document or body outer HTML.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:31 UTC. All times on this page are UTC.
Applications that use HtmlSanitizer's SanitizeDom(string) on untrusted HTML and then output the serialized document or body outer HTML are exposed. Applications that only use other sanitizer methods, or that do not render untrusted HTML through this path, are less likely to be affected.
No product ranges from the sources yet.
dotnet list package for NuGet projects).SanitizeDom(string) and then renders the result with document or body outer HTML.9.2.1039 or later on the 9.x line, or to 10.0.1037-beta or later on the 10.0 prerelease line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.
This page as .md · .json · in your agent: get_signal("CVE-2026-116538")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.