CVE-2026-25543CWE-116

HtmlSanitizer has a bypass via template tag

Medium · published February 4, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
33.0
In the wild
Unconfirmed
What it is

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. Prior to versions 9.0.892 and 9.1.893-beta, if the template tag is allowed, its contents are not sanitized. The template tag is a special tag that does not usually render its contents, unless the shadowrootmode attribute is set to open or closed. This issue has been patched in versions 9.0.892 and 9.1.893-beta.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00399 · 33.0th percentile
Weakness
CWE-116 · Improper Encoding or Escaping of Output
Published
2026-02-04T21:45Z
EPSS history
Timeline
  • 04 FEB 21:45Z
    HtmlSanitizer has a bypass via template tag
    cvelistv5