CVE-2026-54570
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
AngleSharp before 1.5.0 does not treat MathAnnotationXmlElement as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing tokens to be routed through foreign-content parsing instead of HTML parsing. A sanitizer can observe a different DOM from the browser that reparses the serialized output. An attacker can combine this namespace differential with markup-breaking characters in an attribute value so that an element hidden from the sanitizer becomes active script-capable HTML after browser reparse, resulting in mutation cross-site scripting.
Risk Assessment
Applications using AngleSharp for HTML sanitization may allow malicious code to execute in the user's browser, leading to data theft or session hijacking.
Recommendation
Update AngleSharp to version 1.5.0 or later.
Original NVD description (English source)
AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing Consume in AngleSharp/Html/Parser/HtmlDomBuilder.cs to route tokens through foreign-content parsing instead of HTML parsing. A sanitizer can therefore observe a different DOM from the browser that reparses the serialized output. An attacker can combine this namespace differential with markup-breaking characters in an attribute value so that an element hidden from the sanitizer becomes active script-capable HTML after browser reparse, resulting in mutation cross-site scripting. This issue is fixed in version 1.5.0.