CVE-2026-54570 AngleSharp: HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass

AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing...

CVE-2026-54570

AngleSharp versions prior to 1.5.0 fail to assign NodeFlags.HtmlTip to MathAnnotationXmlElement, causing token dispatch to route through foreign-content parsing instead of HTML parsing. Combined with unescaped characters in attribute values, this allows an attacker to hide malicious elements fro...

CVE-2026-54570

creationtimestamp| type| source ---|---|--- 2026-07-17 22:35:05+00:00| published-proof-of-concept| https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg...