CVE-2026-54570: AngleSharp MathML XSS Vulnerability

CVE-2026-54570 Overview

CVE-2026-54570 affects AngleSharp, a .NET library for parsing angle bracket based hyper-texts. Versions prior to 1.5.0 fail to treat MathAnnotationXmlElement as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml. This parsing gap creates a namespace differential between AngleSharp-based sanitizers and browsers that later reparse the serialized output. Attackers can leverage this differential to smuggle script-capable HTML past sanitizers, resulting in mutation cross-site scripting (mXSS). The issue is classified as [CWE-80] and is fixed in AngleSharp 1.5.0.

Critical Impact
Sanitizers built on vulnerable AngleSharp versions can be bypassed, allowing script execution in downstream browsers that reparse the sanitized markup.

Affected Products

AngleSharp versions prior to 1.5.0
.NET applications using AngleSharp for HTML parsing or sanitization
Downstream libraries and services embedding AngleSharp for content sanitization

Discovery Timeline

2026-08-18 - CVE-2026-54570 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-54570

Vulnerability Analysis

AngleSharp implements the HTML5 parsing algorithm, which defines specific MathML elements as HTML integration points. When the parser encounters an integration point inside foreign content, it must switch tokenization back to the HTML insertion mode. The vulnerable code in AngleSharp/Html/Parser/HtmlDomBuilder.cs did not correctly identify <annotation-xml> with encoding="text/html" or encoding="application/xhtml+xml" as an HTML integration point.

As a result, tokens inside the annotation-xml element were routed through foreign-content parsing instead of HTML parsing. A sanitizer using AngleSharp would build a DOM that differed from the DOM produced by a browser reparsing the serialized output. An attacker combines this namespace differential with markup-breaking characters in an attribute value. The sanitizer sees an inert element, but the browser reparses the same serialized string into active, script-capable HTML.

Root Cause

The root cause lives in the Consume method inside AngleSharp/Html/Parser/HtmlDomBuilder.cs. The parser used a NodeFlags.HtmlTip check that did not account for the annotation-xml encoding attribute. Without recognizing this integration point, subsequent tokens were dispatched through foreign-content rules, producing a DOM inconsistent with the HTML5 specification and modern browsers.

Attack Vector

Exploitation requires the attacker to submit crafted HTML containing a MathML annotation-xml element with an encoding value of text/html or application/xhtml+xml. The attacker embeds markup-breaking characters in an attribute value inside this element. When AngleSharp sanitizes and serializes the input, the resulting string is safely rendered on the sanitizer side. When a browser reparses the serialized output, the markup reforms into executable script content, triggering mXSS in the victim's session.

text

// Patch: src/AngleSharp/Html/Parser/HtmlDomBuilder.cs
            if (node is null || token.Type == HtmlTokenType.EndOfFile ||
                node.Flags.HasFlag(NodeFlags.HtmlMember) ||
-                (node.Flags.HasFlag(NodeFlags.HtmlTip) && token.IsHtmlCompatible) ||
+                (token.IsHtmlCompatible && IsHtmlTip(node)) ||
                 (node.Flags.HasFlag(NodeFlags.MathTip) && token.IsMathCompatible) ||
                 (node.Flags.HasFlag(NodeFlags.MathMember) && token.IsSvg &&
                  node.LocalName.Is(TagNames.AnnotationXml)))

Source: GitHub Commit 8033a5c

The patch replaces the static HtmlTip flag check with a dynamic IsHtmlTip(node) call that evaluates the encoding attribute on annotation-xml.

Detection Methods for CVE-2026-54570

Indicators of Compromise

Inbound user content containing <math> or <annotation-xml> elements with encoding="text/html" or encoding="application/xhtml+xml"
Sanitized output that still contains MathML integration-point wrappers around attacker-controlled attributes
Unexpected script execution or DOM mutations in pages rendering AngleSharp-sanitized content

Detection Strategies

Inventory .NET applications and identify those referencing AngleSharp package versions earlier than 1.5.0.
Perform differential parsing tests by comparing DOM output from AngleSharp against a modern browser for MathML annotation-xml payloads.
Add web application firewall (WAF) rules that inspect submitted HTML for MathML integration-point patterns combined with markup-breaking characters in attribute values.

Monitoring Recommendations

Log all user-submitted HTML payloads passing through sanitizer pipelines and retain the pre- and post-sanitization strings for forensic review.
Monitor Content Security Policy (CSP) violation reports for inline script events on pages rendering user-supplied content.
Alert on outbound requests from browser sessions to attacker-controlled hosts that follow the rendering of sanitized content.

How to Mitigate CVE-2026-54570

Immediate Actions Required

Upgrade all AngleSharp dependencies to version 1.5.0 or later across production, staging, and build systems.
Audit transitive dependencies with dotnet list package --include-transitive to identify indirect uses of vulnerable AngleSharp versions.
Redeploy applications that embed AngleSharp for HTML sanitization after upgrading the library.

Patch Information

AngleSharp 1.5.0 fixes the vulnerability by correctly identifying annotation-xml with text/html or application/xhtml+xml encoding as an HTML integration point. Details are available in the GitHub Security Advisory GHSA-pgww-w46g-26qg and the GitHub Release Version 1.5.0. The corrective commit is GitHub Commit 8033a5c.

Workarounds

Strip or reject any user-submitted HTML containing <annotation-xml> elements before passing content to AngleSharp.
Enforce a strict Content Security Policy that disables inline scripts and restricts script sources to trusted origins.
Apply a secondary sanitization pass using an independent parser to detect namespace differentials before serving content to browsers.

bash

# Upgrade AngleSharp to the patched version
dotnet add package AngleSharp --version 1.5.0

# Verify the installed version
dotnet list package | grep -i AngleSharp