CVE-2023-44390 HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content

What is CVE-2023-44390?

CVE-2023-44390 is a medium-severity cross-site scripting vulnerability in mganss HtmlSanitizer, published on 5 Oct 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability occurs in configurations where foreign content is allowed, i.e. either `svg` or `math` are in the list of allowed elements. In the case an application sanitizes user input with a vulnerable configuration, an attacker could bypass the sanitization and inject arbitrary HTML, including JavaScript code. Note that in the default configuration the vulnerability is not present. The vulnerability has been fixed in versions 8.0.723 and 8.1.722-beta (preview version).

Weakness: CWE-79

Which versions are affected by CVE-2023-44390?

4 open source packages ship an affected version, including HtmlSanitizer. It affects 1 product.

Products include Htmlsanitizer Project Htmlsanitizer.

How do I fix CVE-2023-44390?

Upgrade HtmlSanitizer to a fixed version for your release line: 8.0.723 or 8.1.722-beta.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-44390 being exploited?

There is no known exploitation of CVE-2023-44390 in the wild and no public exploit code.

Other vulnerabilities in mganss HtmlSanitizer

• CVE-2026-25543 HtmlSanitizer has a bypass via template tag Medium 6.3
• CVE-2020-26293 Possible XSS bypass if style tag is allowed Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-43cp-6p3q-2pc4.