EUVD-2026-61128
GHSA-pgww-w46g-26qg
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N
AC:H for chained conditions requiring annotation-xml, RCDATA elements, and browser re-parse; S:C and I:H because XSS executes in the victim browser as a subsequent system.
Primary rating from Vendor (https://github.com/AngleSharp/AngleSharp).
CVSS VectorVendor: https://github.com/AngleSharp/AngleSharp
Lifecycle Timeline
2DescriptionCVE.org
Summary
The HTML specification requires that a MathML <annotation-xml> element with encoding="text/html" or encoding="application/xhtml+xml" is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML.
AngleSharp does not implement this correctly. As a result, the parser produces a DOM tree that differs from what a browser will build (different namespaces if encoding="text/html" is not treated) when given the same serialized output. Two bugs combine to make this exploitable:
- Missing HtmlTip flag: MathAnnotationXmlElement is never assigned NodeFlags.HtmlTip based on its encoding attribute, so the Consume() dispatch always routes tokens to Foreign() instead of Home() (HTML mode).
- Unescaped < > in attribute values: HtmlMarkupFormatter.WriteAttributeValue() does not escape < or > characters, only & and ". This allows injected markup to break out of attribute values on re-parse. _See [Escape "<" and ">" in attributes when serializing HTML #6235
](https://github.com/whatwg/html/issues/6235)_
Details
In MathAnnotationXmlElement (AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs):
// Current - HtmlTip is never set
: base(owner, TagNames.AnnotationXml, prefix, NodeFlags.Special | NodeFlags.Scoped)Because HtmlTip is absent, the token dispatch in Consume() always sends tokens to Foreign() when inside annotation-xml, regardless of the encoding attribute. The compensating check in ForeignNormalTag() only covers tags in AllForeignExceptions and is entirely bypassed during fragment parsing (innerHTML setter) due to an if (!IsFragmentCase) guard.
In HtmlMarkupFormatter.WriteAttributeValue() (AngleSharp/Html/HtmlMarkupFormatter.cs):
// Escapes & " and \u00A0, but NOT < or >
case Symbols.Ampersand: stringBuilder.Append("&"); break;
case Symbols.NoBreakSpace: stringBuilder.Append(" "); break;
case Symbols.DoubleQuote: stringBuilder.Append("""); break;
default: stringBuilder.Append(value[i]); break; // < and > pass through rawPoC
The following program demonstrates that AngleSharp’s parser misses the injected <img> element. A sanitizer walking this DOM would see nothing dangerous, yet the serialized output re-parses in a browser as a live <img onerror> trigger.
using System;
using System.Linq;
using AngleSharp.Html.Parser;
public class Program
{
static readonly string Payload1 =
"<math>" +
"<annotation-xml encoding=\"text/html\">" +
"<title><a encoding=\"</title><img src=x onerror=alert()>\">" +
"</annotation-xml></math>";
public static void Main()
{
var parser = new HtmlParser();
Check(parser, Payload1, "IMG",
"AngleSharp missed <img> - VULNERABLE (mXSS via attribute serialization)",
"AngleSharp found <img> - SAFE");
}
static void Check(HtmlParser parser, string html, string tag,
string failMsg, string passMsg)
{
var doc = parser.ParseDocument(html);
var tags = doc.All.Select(e => e.TagName).ToHashSet();
var found = tags.Contains(tag);
Console.WriteLine(found ? passMsg : failMsg);
Console.WriteLine("Serialized output:");
Console.WriteLine(doc.DocumentElement.OuterHtml);
}
}Output:
AngleSharp missed <img> - VULNERABLE (mXSS via attribute serialization)
Serialized output:
<html><head></head><body><math><annotation-xml encoding="text/html"><title><a encoding="</title><img src=x onerror=alert()>"></a></title></annotation-xml></math></body></html>_The title tag may be swapped out for style and other RCDATA elements._
When a browser receives this string and parses annotation-xml encoding="text/html" as an HTML integration point, the </title> closes the title element and the <img> fires its onerror handler.
Impact
Implemented HTML sanitizers that depend and trust AngleSharp's ability to parse HTML correctly may be bypassable, as AngleSharp fails to acknowledge certain vectors under certain conditions.
This reduces AngleSharp's credibility as a conformant HTML parser.
AnalysisAI
Mutation XSS (mXSS) in AngleSharp versions before 1.5.0 allows sanitizer bypass through two compounding parser flaws: the MathML annotation-xml element never receives the HtmlTip flag, causing the parser to diverge from browser behavior, and the HTML serializer emits unescaped angle brackets in attribute values. Applications using AngleSharp as an HTML sanitizer before browser rendering are vulnerable - the sanitizer inspects a benign DOM while the serialized output re-parses in browsers with live XSS payloads active. A detailed public proof-of-concept is included in the upstream advisory (GHSA-pgww-w46g-26qg); no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Technical ContextAI
AngleSharp (pkg:nuget/anglesharp) is a .NET HTML5 parsing library commonly used for server-side HTML sanitization. The HTML5 specification designates MathML annotation-xml elements carrying encoding='text/html' or encoding='application/xhtml+xml' as HTML integration points - their content must be parsed as HTML, not MathML. Two independent defects in AngleSharp combine into an exploitable mXSS chain. First, MathAnnotationXmlElement (AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs) never sets NodeFlags.HtmlTip in its constructor, so Consume() unconditionally dispatches tokens to Foreign() mode regardless of the encoding attribute, producing a DOM namespace tree that diverges from what a conformant browser builds. A partial compensating check in ForeignNormalTag() covers only tags in AllForeignExceptions and is completely bypassed during innerHTML/fragment parsing due to an if (!IsFragmentCase) guard. Second, HtmlMarkupFormatter.WriteAttributeValue() (AngleSharp/Html/HtmlMarkupFormatter.cs) escapes ampersand, double-quote, and non-breaking space but passes raw < and > characters through to the serialized output. This violates the HTML serialization spec requirement referenced in whatwg/html issue #6235. The root cause class is CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page.
RemediationAI
Upgrade AngleSharp to version 1.5.0 or later, which explicitly patches GHSA-pgww-w46g-26qg. The release is available via NuGet and documented at https://github.com/AngleSharp/AngleSharp/releases/tag/1.5.0. If an immediate upgrade is not feasible, the primary compensating control is to avoid the sanitize-then-re-render pattern: do not pass AngleSharp's OuterHtml serialized output directly to a browser parser. Applications performing server-side HTML sanitization should either introduce an additional serialization-safe layer or switch temporarily to a parser that correctly implements the HTML5 integration point specification. Restricting or rejecting input containing MathML annotation-xml elements at an input validation layer is a targeted workaround but may break legitimate MathML content. Note that the innerHTML setter code path is specifically more vulnerable because the IsFragmentCase guard bypasses the partial ForeignNormalTag() compensating check - fragment parsing scenarios should be treated as highest priority.
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today