{"id":"CVE-2026-25543","aliases":["GHSA-j92c-7v7g-gj3f"],"url":"https://o3.security/vulnerability/CVE-2026-25543","summary":"HtmlSanitizer has a bypass via template tag","details":"### Impact\n\nIf the `template` tag is allowed, its contents are not sanitized. The `template` tag is a special tag that does not usually render its contents, unless the `shadowrootmode` attribute is set to `open` or `closed`. \n\nThe lack of sanitization of the template tag brings up two bypasses:\n\n1. it is still possible to forcibly render the contents of a `<template>` tag through mutation XSS. The DOM parsers in browsers such as Chromium have a node depth limit of 512 and tags which are beyond that depth are flattened. This in turn allows elements within `<template>` (which are not sanitized) to be effectively 'popped out'. An example would look like this: `<div>[...]<template><script>alert('xss')</script>` where `[...]` denotes at least another 509 opening `<div>` tags.\n2. If in addition to the template tag, the `shadowrootmode` attribute is allowed through `sanitizer.AllowedAttributes.Add(\"shadowrootmode\");`, the simple payload of `<div><template shadowrootmode=\"open\"><script>alert('xss')</script>` would bypass the sanitizer. This is because such usage of `<template>` attaches a shadow root to its parent: `<div>`, and its contents will be rendered. \n\nNote that the default configuration is not affected because the `template` tag is disallowed by default.\n\n### Patches\n\nThe problem has been patched in versions [9.0.892](https://www.nuget.org/packages/HtmlSanitizer/9.0.892) and [9.1.893-beta](https://www.nuget.org/packages/HtmlSanitizer/9.1.893-beta).\n\n### Workarounds\n\nDisallow the `template` tag. It is disallowed by default.\n\n### Resources\n\nhttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template","published":"2026-02-04T21:45:25.665Z","modified":"2026-08-12T03:51:08.142843366Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"HtmlSanitizer","fixedVersion":"9.0.892"},{"ecosystem":"NuGet","name":"HtmlSanitizer","fixedVersion":"9.1.893-beta"}],"fix":{"url":"https://github.com/mganss/HtmlSanitizer/commit/0ac53dca30ddad963f2b243669a5066933d82b81","label":"mganss/HtmlSanitizer@0ac53dc"},"references":[{"type":"WEB","url":"https://www.nuget.org/packages/HtmlSanitizer/9.0.892"},{"type":"WEB","url":"https://www.nuget.org/packages/HtmlSanitizer/9.1.893-beta"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25543.json"},{"type":"ADVISORY","url":"https://github.com/mganss/HtmlSanitizer/security/advisories/GHSA-j92c-7v7g-gj3f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25543"},{"type":"FIX","url":"https://github.com/mganss/HtmlSanitizer/commit/0ac53dca30ddad963f2b243669a5066933d82b81"},{"type":"WEB","url":"https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template"},{"type":"PACKAGE","url":"https://github.com/mganss/HtmlSanitizer"},{"type":"WEB","url":"https://github.com/mganss/HtmlSanitizer/releases/tag/v9.0.892"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:08.142843366Z"}}