CVE-2026-116538 HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes

Low 2.3 Published 26 Oct 2026 Updated 26 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-116538?

CVE-2026-116538 is a low-severity vulnerability in mganss HtmlSanitizer, published on 26 Oct 2026.

Official description

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.

Weakness: CWE-79

Which versions are affected by CVE-2026-116538?

How do I fix CVE-2026-116538?

No fix has been published for CVE-2026-116538 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116538 being exploited?

There is no known exploitation of CVE-2026-116538 in the wild and no public exploit code.

Sources

Also known as GHSA-qw8f-hph4-7r4g.