CVE-2026-25543
📋 TL;DR
HtmlSanitizer versions before 9.0.892 and 9.1.893-beta fail to sanitize content within template tags when those tags are allowed, potentially enabling cross-site scripting (XSS) attacks. This affects any .NET application using vulnerable versions of the HtmlSanitizer library to clean user-supplied HTML. Attackers could inject malicious scripts that execute when template content is rendered with shadowrootmode attributes.
💻 Affected Systems
- HtmlSanitizer .NET library
📦 What is this software?
Htmlsanitizer by Htmlsanitizer Project
Htmlsanitizer by Htmlsanitizer Project
⚠️ Risk & Real-World Impact
Worst Case
Full XSS compromise allowing attackers to steal session cookies, perform actions as authenticated users, or deface websites.
Likely Case
Limited XSS exploitation in applications that allow template tags and render their contents, potentially leading to session hijacking or data theft.
If Mitigated
No impact if template tags are disallowed in sanitizer configuration or if shadowrootmode attributes are blocked.
🎯 Exploit Status
Exploitation requires template tags to be allowed and their contents to be rendered with shadowrootmode attributes.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.0.892 or 9.1.893-beta
Vendor Advisory: https://github.com/mganss/HtmlSanitizer/security/advisories/GHSA-j92c-7v7g-gj3f
Restart Required: Yes
Instructions:
1. Update HtmlSanitizer NuGet package to version 9.0.892 or 9.1.893-beta. 2. Rebuild and redeploy affected applications. 3. Restart application services.
🔧 Temporary Workarounds
Disable template tags
allConfigure HtmlSanitizer to disallow template tags entirely
sanitizer.AllowedTags.Remove("template");
Block shadowrootmode attribute
allPrevent template tags from rendering content by blocking shadowrootmode attribute
sanitizer.AllowedAttributes.Remove("shadowrootmode");
🧯 If You Can't Patch
- Implement output encoding for any content that passes through HtmlSanitizer
- Deploy WAF rules to detect and block XSS attempts involving template tags
🔍 How to Verify
Check if Vulnerable:
Check if HtmlSanitizer version is below 9.0.892 and template tags are allowed in configurationCheck Version:
Check packages.config or .csproj file for HtmlSanitizer versionVerify Fix Applied:
Verify HtmlSanitizer package version is 9.0.892 or higher in project dependencies📡 Detection & Monitoring
Log Indicators:
- Unusual HTML input containing template tags with shadowrootmode attributes
- XSS filter bypass attempts
Network Indicators:
- HTTP requests containing malicious script payloads within template tags
SIEM Query:
source="web_logs" AND (template AND shadowrootmode) OR (script AND template)