cyfenced.com →

[ CVE-2026-116538 · Published 26 Oct 2026 ]

Vulnerability in mganss HtmlSanitizer

CVSS 4.7 EPSS <1%No fix listed yet

[ Description ]Official description

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References