CVE-2026-116538 in HtmlSanitizer
Summary
by MITRE • 10/26/2026
HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The HtmlSanitizer library, prior to versions 9.2.1039 and 10.0.1037-beta, contains a critical cross-site scripting vulnerability rooted in the incomplete sanitization of wrapper elements within the Document Object Model. This flaw specifically affects the SanitizeDom method, which fails to apply attribute filtering rules to the root html and body tags that encapsulate the parsed HTML content. In standard web application development using this library, developers often rely on the sanitizer to strip malicious scripts from user-supplied input before rendering it in a browser context. However, because the sanitization logic does not traverse or validate attributes attached directly to these top-level wrapper elements, any event handlers injected into them remain intact and executable.
The technical mechanism of exploitation involves an attacker supplying HTML input that includes nested html or body tags containing dangerous JavaScript event handlers, such as onload, onerror, or onclick. When the vulnerable version of HtmlSanitizer processes this input via SanitizeDom(string), it correctly sanitizes attributes within child elements but neglects to inspect the root wrapper nodes for malicious payloads. Consequently, when an application subsequently renders the sanitized output by accessing properties like outerHTML or innerHTML, the browser interprets these preserved event handlers as valid code. This results in the immediate execution of arbitrary JavaScript in the context of the victim user's session, bypassing the intended security controls provided by the sanitizer library itself.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The specific nature of this flaw represents an incomplete sanitization strategy where certain entry points or structural elements are overlooked during the cleaning process. In terms of offensive security frameworks, this behavior maps to MITRE ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution. Attackers can leverage this weakness to perform session hijacking, defacement, keylogging, or redirection attacks by injecting scripts that execute automatically upon page load without requiring further user interaction beyond the initial request containing the malicious payload.
The operational impact of this vulnerability is significant for any application relying on HtmlSanitizer to process untrusted HTML content. Since the attack does not require complex encoding tricks or specific browser quirks, it is highly reliable and easy to exploit remotely. Successful exploitation allows an attacker to execute scripts with the same privileges as legitimate users, potentially leading to full account compromise if session tokens are accessible via JavaScript. Furthermore, because the vulnerability exists in a widely used utility library, it affects numerous downstream applications that may not be aware of this specific edge case regarding wrapper element sanitization, thereby amplifying the potential blast radius across multiple systems and user bases.
To mitigate this risk, organizations must immediately upgrade to HtmlSanitizer version 9.2.1039 or later for the stable branch, or version 10.0.1037-beta or later for prerelease versions. These updated releases address the oversight by ensuring that attribute sanitization rules are consistently applied to all elements in the DOM tree, including the root html and body wrappers. In addition to upgrading, developers should implement defense-in-depth strategies such as Content Security Policy headers to restrict script execution sources and validate input at multiple layers of the application stack rather than relying solely on a single library for security guarantees. Regular auditing of third-party dependencies is also recommended to ensure that known vulnerabilities in utility libraries are promptly identified and resolved before they can be exploited in production environments.