CVE-2026-116538
Received Received - Intake

Cross-Site Scripting in HtmlSanitizer via Unsanitized HTML Attributes

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulnCheck

Description
HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116538
EUVD
EUVD-2026-109908

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mganss HtmlSanitizer 0
mganss HtmlSanitizer 10.0.0-beta

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

HtmlSanitizer before versions 9.2.1039 and 10.0 prereleases before 10.0.1037-beta has a cross-site scripting (XSS) vulnerability. The SanitizeDom function fails to sanitize attributes on html and body wrapper elements. Attackers can inject a second html or body tag with event handlers like onload, which executes scripts when applications render serialized document or body outer HTML.

Detection Guidance

To detect this vulnerability, inspect applications using HtmlSanitizer versions before 9.2.1039 or 10.0 prereleases before 10.0.1037-beta. Check for input containing nested html or body tags with event handlers like onload in serialized output.

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in the context of a user's browser session. This could lead to theft of session cookies, sensitive data exposure, or unauthorized actions performed on behalf of the user. Applications using affected HtmlSanitizer versions may render unsafe HTML content.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information, risking compliance with security requirements. Organizations must address this to maintain regulatory compliance.

Mitigation Strategies

Update HtmlSanitizer to version 9.2.1039 or later, or 10.0.1037-beta or later. Review and sanitize all user-supplied input to prevent nested html or body tags with event handlers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116538. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart