CVE-2026-116538

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDomstring never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like...

CVE-2026-116538

The HtmlSanitizer library (versions before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta ) is vulnerable to Cross-Site Scripting (XSS) . The root cause is that the SanitizeDom(string) function fails to sanitize attributes on the and wrapper elements. An attacker can provide input containi...

EUVD-2026-109908

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDomstring never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like...