CVE-2026-116538: HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes
HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HtmlSanitizerto a version that resolves this vulnerability.Fixed in 9.2.1039 - Upgrade
Upgrade
HtmlSanitizerto a version that resolves this vulnerability.Fixed in 10.0.1037-beta
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using HtmlSanitizer versions before 9.2.1039, or 10.0 prereleases before 10.0.1037-beta, are affected when they use SanitizeDom(string) and render serialized document or body outer HTML.
What must an attacker be able to do to exploit this?
An attacker must be able to supply HTML that reaches SanitizeDom(string). The supplied input can include a second html or body element with an event-handler attribute such as onload.
How can I determine whether an application is affected?
Review the installed HtmlSanitizer version and identify uses of SanitizeDom(string). Applications that subsequently serialize and render document or body outer HTML should be treated as affected on vulnerable versions.
What version should be used to remediate the issue?
Upgrade to HtmlSanitizer 9.2.1039 or later. For the 10.0 prerelease line, use 10.0.1037-beta or later.