CVE-2026-97045
Low risk· EPSS 10%Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
In childTextNodesAreLiteral, tree walking stopped at the nearest foreign ancestor once an HTML integration point was found. Because that integration point may itself be a descendant of a foster-parented element in a foreign namespace, a parser may resolve the subtree in a different namespace upon re-parsing rendered output. The fix continues walking the full ancestor chain and verifies every namespace transition occurs at an HTML integration point.
Risk Assessment
Parsing inconsistency may lead to incorrect HTML interpretation, potentially enabling sanitizer bypass and mutation XSS vulnerabilities.
Recommendation
Update the HTML parser library to a patched version and verify HTML sanitization behavior in applications.
Other vulnerabilities in HTML parser
See all- CVE-2026-78661Low risk· EPSS 8%
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation reallocated and copied the accumulated string on every token. Inputs with many short text runs separated by ignored end tags caused O(n^2) allocations and byte copies. The fix accumulates coalesced text in per-node byte slices and materializes Data strings once at the end of parsing.
- CVE-2026-25680Medium
Parsing arbitrary HTML can consume excessive CPU time, leading to denial of service (DoS).
Original NVD description (English source)
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS