CVE-2026-25543 HtmlSanitizer has a bypass via template tag
Attackers can bypass HTML sanitization via template tags to inject malicious scripts, leading to cross-site scripting attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25543?
CVE-2026-25543 is a medium-severity cross-site scripting vulnerability in mganss HtmlSanitizer, published on 4 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. Prior to versions 9.0.892 and 9.1.893-beta, if the template tag is allowed, its contents are not sanitized. The template tag is a special tag that does not usually render its contents, unless the shadowrootmode attribute is set to open or closed. This issue has been patched in versions 9.0.892 and 9.1.893-beta.
Which versions are affected by CVE-2026-25543?
4 open source packages ship an affected version, including HtmlSanitizer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
HtmlSanitizer NuGet | All versions | 9.0.892 |
HtmlSanitizer NuGet | All versions | 9.0.892 |
HtmlSanitizer NuGet | From 9.1.878-beta | 9.1.893-beta |
HtmlSanitizer NuGet | From 9.1.878-beta | 9.1.893-beta |
Products include Htmlsanitizer Project Htmlsanitizer.
How do I fix CVE-2026-25543?
Upgrade HtmlSanitizer to a fixed version for your release line: 9.0.892 or 9.1.893-beta.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-25543 being exploited?
There is no known exploitation of CVE-2026-25543 in the wild and no public exploit code.
Other vulnerabilities in mganss HtmlSanitizer
Sources
Also known as ECHO-b56b-174c-3d1b, GHSA-j92c-7v7g-gj3f.