CVE-2026-25543: HtmlSanitizer .NET Library XSS Flaw

CVE-2026-25543 Overview

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. A Cross-Site Scripting (XSS) bypass vulnerability exists in versions prior to 9.0.892 and 9.1.893-beta. When the <template> tag is allowed in the sanitization configuration, its contents are not properly sanitized. The <template> tag is a special HTML element that does not typically render its contents unless the shadowrootmode attribute is set to open or closed, creating a potential avenue for XSS attacks.

Critical Impact
Applications using HtmlSanitizer with the template tag allowed may be vulnerable to XSS attacks, potentially allowing attackers to execute malicious scripts in users' browsers, steal session cookies, or perform actions on behalf of authenticated users.

Affected Products

HtmlSanitizer versions prior to 9.0.892
HtmlSanitizer versions prior to 9.1.893-beta
.NET applications using vulnerable HtmlSanitizer versions with template tag allowed

Discovery Timeline

February 4, 2026 - CVE-2026-25543 published to NVD
February 5, 2026 - Last updated in NVD database

Technical Details for CVE-2026-25543

Vulnerability Analysis

This vulnerability is classified under CWE-116 (Improper Encoding or Escaping of Output), which occurs when software fails to properly encode or escape output before it is rendered in a web page. In the context of HtmlSanitizer, the library is specifically designed to prevent XSS attacks by sanitizing potentially dangerous HTML constructs. However, when the <template> tag is explicitly allowed in the sanitizer configuration, the library fails to recursively sanitize the contents within the template element.

The <template> tag in HTML serves as a mechanism to hold client-side content that is not rendered when the page loads. However, modern Shadow DOM functionality allows template contents to be rendered when the shadowrootmode attribute is set to open or closed. This creates a scenario where unsanitized content within the template tag could be executed in the DOM context.

Root Cause

The root cause of this vulnerability lies in the HtmlSanitizer's handling of the <template> tag's internal content. The sanitization logic treats the template element as a container but fails to apply the same sanitization rules to its child nodes. This design assumption was based on the traditional behavior of template tags not rendering their contents, overlooking the Shadow DOM specifications that allow template content rendering via the shadowrootmode attribute.

Attack Vector

The attack requires network access and targets applications that use HtmlSanitizer with the template tag in the allowed tags list. An attacker can craft malicious HTML input containing a <template> element with unsanitized JavaScript or event handlers inside. When this content is processed by the vulnerable HtmlSanitizer and the resulting HTML is rendered in a context where Shadow DOM is active, the malicious scripts can execute.

The attack scenario involves submitting user-controlled HTML content that includes a template tag with malicious payload. When the application processes this through HtmlSanitizer and renders it to other users, the XSS payload executes in the victim's browser context.

Detection Methods for CVE-2026-25543

Indicators of Compromise

Presence of <template> tags with shadowrootmode attribute in user-submitted content
Unusual JavaScript execution originating from template element contents
Web application firewall logs showing attempts to inject template tags with script content
Browser console errors or unexpected script execution in Shadow DOM contexts

Detection Strategies

Review application code for HtmlSanitizer usage and check if template tags are in the allowed tags configuration
Implement web application firewall rules to detect and log attempts to submit template tags with suspicious content
Audit NuGet package references to identify vulnerable HtmlSanitizer versions in .NET projects
Enable Content Security Policy (CSP) headers to detect and report inline script execution attempts

Monitoring Recommendations

Monitor application logs for HTML submissions containing <template> tags with embedded scripts or event handlers
Set up dependency scanning in CI/CD pipelines to alert on vulnerable HtmlSanitizer versions
Implement browser-side monitoring for unexpected script execution within Shadow DOM boundaries
Track CSP violation reports for indicators of XSS exploitation attempts

How to Mitigate CVE-2026-25543

Immediate Actions Required

Update HtmlSanitizer to version 9.0.892 or 9.1.893-beta immediately
Review application configurations to determine if the template tag is in the allowed tags list
Remove template tag from allowed tags if not required for application functionality
Audit existing user-generated content for potentially malicious template tag usage

Patch Information

The vulnerability has been patched in HtmlSanitizer versions 9.0.892 and 9.1.893-beta. The fix ensures that contents within template tags are properly sanitized when the template tag is allowed. The patched versions are available via NuGet:

Stable release: NuGet Package Version 9.0.892
Beta release: NuGet Package Beta Version 9.1.893

For technical details on the fix implementation, refer to the GitHub Commit Details and the GitHub Security Advisory.

Workarounds

Remove the template tag from the allowed tags list in HtmlSanitizer configuration if the functionality is not required
Implement additional server-side validation to strip or reject input containing template tags with shadowrootmode attributes
Apply Content Security Policy headers with strict inline script restrictions to mitigate XSS impact
Consider implementing output encoding as an additional defense layer for content rendered from user input

bash

# Example: Update HtmlSanitizer via .NET CLI
dotnet add package HtmlSanitizer --version 9.0.892

# Example: Update via Package Manager Console
Install-Package HtmlSanitizer -Version 9.0.892