CVE-2026-116538 json
HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes
published 14d ago modified 10d ago also EUVD-2026-109908
- cvss
- 4.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 21%
- public exploits
- 0
- none known
Summary
HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.
Patch / fix
- mganss HtmlSanitizer 9.2.1039, 10.0.1037-beta
Is CVE-2026-116538 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10d ago
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
| CNA | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- mganss HtmlSanitizer
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/mganss/HtmlSanitizer/commit/96afbc818e64de7571ea17954a05d523e819c56f
patch
-
github.com
/mganss/HtmlSanitizer/commit/ab626e7a4f2893f7e9ec0a72779ae19c5ec439a7
patch
-
github.com
/mganss/HtmlSanitizer/blob/v9.2.995/src/HtmlSanitizer/HtmlSanitizer.cs#L456-L465
technical-description
-
github.com
/mganss/HtmlSanitizer/blob/v9.2.995/src/HtmlSanitizer/HtmlSanitizer.cs#L555-L583
technical-description
-
joshua.hu
/htmlsanitizer-sanitizedom-body-html-attribute-bypass
technical-description
-
github.com
/mganss/HtmlSanitizer/releases/tag/v9.2.1039
release-notes
-
github.com
/mganss/HtmlSanitizer/releases/tag/v10.0.1037-beta
release-notes
-
github.com
/mganss/HtmlSanitizer
product
-
vulncheck.com
/advisories/htmlsanitizer-before-9.2.1039-xss-via-sanitizedom-body-and-html-attributes
third-party-advisory
Sources
- CVE List CVE-2026-116538
- NVD CVE-2026-116538
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.