CVE-2026-116538Published
HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-116538 · Microsoft / collected KEV context
cve-program · CVE-2026-116538
- https://github.com/mganss/HtmlSanitizer/commit/96afbc818e64de7571ea17954a05d523e819c56f
- https://github.com/mganss/HtmlSanitizer/commit/ab626e7a4f2893f7e9ec0a72779ae19c5ec439a7
- https://github.com/mganss/HtmlSanitizer/blob/v9.2.995/src/HtmlSanitizer/HtmlSanitizer.cs#L456-L465
- https://github.com/mganss/HtmlSanitizer/blob/v9.2.995/src/HtmlSanitizer/HtmlSanitizer.cs#L555-L583
- https://joshua.hu/htmlsanitizer-sanitizedom-body-html-attribute-bypass
- https://github.com/mganss/HtmlSanitizer/releases/tag/v9.2.1039
- https://github.com/mganss/HtmlSanitizer/releases/tag/v10.0.1037-beta
- https://github.com/mganss/HtmlSanitizer
- https://www.vulncheck.com/advisories/htmlsanitizer-before-9.2.1039-xss-via-sanitizedom-body-and-html-attributes
Related operational evidence
Explicit CVE identifiers- HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes · Newly collected advisory · 26 Oct 2026