Htmlsanitizer
Monthly
HtmlSanitizer's SanitizeDom(string) API leaves attributes untouched on the <html> and <body> wrapper elements it parses into, so markup such as a second <body onload=alert(1)> tag can place a live event handler on the returned document. The issue affects releases before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta, and only matters where the caller serializes more than dom.Body.ChildNodes - for example dom.ToHtml() or the body/html outer HTML - and where a victim then renders that output. Severity signals are low (CVSS 4.0 score 2.3; independent assessment CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N), no public exploit or CISA KEV entry is associated with the flaw at time of analysis, and the vendor has released fixed versions.
Htmlsanitizer versions up to 9.0.892 is affected by improper encoding or escaping of output (CVSS 6.1).
HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
HtmlSanitizer's SanitizeDom(string) API leaves attributes untouched on the <html> and <body> wrapper elements it parses into, so markup such as a second <body onload=alert(1)> tag can place a live event handler on the returned document. The issue affects releases before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta, and only matters where the caller serializes more than dom.Body.ChildNodes - for example dom.ToHtml() or the body/html outer HTML - and where a victim then renders that output. Severity signals are low (CVSS 4.0 score 2.3; independent assessment CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N), no public exploit or CISA KEV entry is associated with the flaw at time of analysis, and the vendor has released fixed versions.
Htmlsanitizer versions up to 9.0.892 is affected by improper encoding or escaping of output (CVSS 6.1).
HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.