{"id":"CVE-2026-116538","kind":"vulnerability","aliases":["CVE-2026-116538"],"related":[],"title":"HtmlSanitizer: DOM sanitizer skips html and body attributes, allowing script injection","description":"HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.","summary":"HtmlSanitizer's SanitizeDom(string) method does not sanitize attributes on the html and body wrapper elements. An attacker can supply input with a second body or html tag carrying event handlers such as onload, which runs script when the application renders the serialized document or body outer HTML.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dotnet","html-sanitizer","nuget","package"],"not_affected_if":["does-not-use-sanitizedom","no-untrusted-html"],"how_to_check":"- Check the installed HtmlSanitizer package version in your project file or lock file (for example `dotnet list package` for NuGet projects).\n- Find code that calls `SanitizeDom(string)` and then renders the result with document or body outer HTML.","fix":"- Upgrade HtmlSanitizer to `9.2.1039` or later on the 9.x line, or to `10.0.1037-beta` or later on the 10.0 prerelease line.","status":"open","published_at":"2026-10-26T16:17:19+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","triaged_at":"2026-10-26T16:33:02+00:00","updated_at":"2026-10-26T16:33:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T16:33:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade HtmlSanitizer to `9.2.1039` or later on the 9.x line, or to `10.0.1037-beta` or later on the 10.0 prerelease line.","reach":"internet","title":"HtmlSanitizer: DOM sanitizer skips html and body attributes, allowing script injection","impact":"medium","summary":"HtmlSanitizer's SanitizeDom(string) method does not sanitize attributes on the html and body wrapper elements. An attacker can supply input with a second body or html tag carrying event handlers such as onload, which runs script when the application renders the serialized document or body outer HTML.","category":"package","nicknames":[],"who_cares":["dotnet","nuget","html-sanitizer"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in victim's browser when sanitized output is rendered","analyst_note":"","how_to_check":"- Check the installed HtmlSanitizer package version in your project file or lock file (for example `dotnet list package` for NuGet projects).\n- Find code that calls `SanitizeDom(string)` and then renders the result with document or body outer HTML.","needs_analyst":false,"not_affected_if":["no-untrusted-html","does-not-use-sanitizedom"],"who_is_affected":"Applications that use HtmlSanitizer's SanitizeDom(string) on untrusted HTML and then output the serialized document or body outer HTML are exposed. Applications that only use other sanitizer methods, or that do not render untrusted HTML through this path, are less likely to be affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000628,"input_tokens":3362,"output_tokens":584,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116538':14A,17A '-2026':13A,16A '10.0':76C '10.0.1037':79C '9.2.1039':74C 'allow':9A 'applic':63B,120C 'attack':41B,101C 'attribut':8A,32B,93C 'beta':80C 'bodi':7A,37B,48B,69B,98C,108C,125C 'carri':52B,112C 'contain':81C 'cross':84C 'cross-sit':83C 'cve':12A,15A 'document':67B,123C 'dom':2A 'dotnet':18B 'element':39B,100C 'event':53B,113C 'execut':117C 'handler':54B,114C 'html':5A,20B,35B,50B,71B,96C,110C,127C 'html-sanit':19B 'htmlsanit':1A,24B,72C 'inject':11A 'input':44B,104C 'like':115C 'method':28B 'never':91C 'nuget':22B 'onload':57B,116C 'outer':70B,126C 'packag':23B 'prereleas':77C 'render':64B,121C 'run':59B 'sanit':3A,21B,31B,92C 'sanitizedom':26B,89C 'script':10A,60B,86C,118C 'second':47B,107C 'serial':66B,122C 'site':85C 'skip':4A 'string':27B,90C 'suppli':43B,103C 'tag':51B,111C 'vulner':87C 'wrapper':38B,99C","nicknames":[],"mitigations":[],"who_affected":"Applications that use HtmlSanitizer's SanitizeDom(string) on untrusted HTML and then output the serialized document or body outer HTML are exposed. Applications that only use other sanitizer methods, or that do not render untrusted HTML through this path, are less likely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T16:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116538","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116538","severity":null,"published_at":"2026-10-26T16:17:19+00:00","modified_at":"2026-10-26T16:17:19+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","fetched_at":"2026-10-26T16:31:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}