6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25543

CVE-2026-25543: HtmlSanitizer has a bypass via template tag

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. Prior to versions 9.0.892 and 9.1.893-beta, if the template tag is allowed, its contents are not sanitized. The template tag is a special tag that does not usually render its contents, unless the shadowrootmode attribute is set to open or closed. This issue has been patched in versions 9.0.892 and 9.1.893-beta.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25543

CVE-2026-25543:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
HtmlSanitizer	nuget	< 9.0.892	9.0.892
HtmlSanitizer	nuget	>= 9.1.878-beta, < 9.1.893-beta	9.1.893-beta

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security advisory GHSA-j92c-7v7g-gj3f describes a bypass in the HtmlSanitizer library where the contents of a <template> tag are not sanitized. The provided commit 0ac53dca30ddad963f2b243669a5066933d82b81 is the patch for this vulnerability. Analysis of the patch shows a modification in the DoSanitize method within src/HtmlSanitizer/HtmlSanitizer.cs. Specifically, a new block of code was added to check for IHtmlTemplateElement and then recursively call DoSanitize on its content. The absence of this recursive sanitization for <template> content in the vulnerable versions is the root cause of the vulnerability. Therefore, the DoSanitize function is the identified vulnerable function, as it is responsible for the sanitization process that was being bypassed.

Vulnerable functions

Ganss.Xss.HtmlSanitizer.DoSanitize

src/HtmlSanitizer/HtmlSanitizer.cs

The vulnerability lies in the `DoSanitize` method, which, prior to the patch, did not recursively sanitize the contents of `<template>` elements. If an application allowed the `<template>` tag, any malicious content within it (like `<script>` tags) would not be removed or sanitized. The patch fixes this by adding a recursive call to `DoSanitize` for the content of any found `<template>` element, ensuring its contents are also processed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.