94 matches found
XSS in HtmlSanitizer
Impact If you have explicitly allowed the tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the tag so there is no risk if you have not explicitly allowed the tag. Patches The problem has been fixed in version 5.0.372...
GHSA-8J9V-H2VP-2HHV XSS in HtmlSanitizer
Impact If you have explicitly allowed the tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the tag so there is no risk if you have not explicitly allowed the tag. Patches The problem has been fixed in version 5.0.372...
CVE-2020-26293
HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the "" tag, an attacker could craft HTML that...
CVE-2020-26293
The provided connected documents confirm a concrete vulnerability in HtmlSanitizer (a .NET library) where an XSS bypass is possible in versions before 5.0.372 if the tag is explicitly allowed. The default policy disallows , so risk exists only when that tag is whitelisted. The issue has been fix...
CVE-2020-26293 Possible XSS bypass if style tag is allowed
HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the tag, an attacker could craft HTML that includ...
CVE-2020-26293: Improper Neutralization of Special Elements in Output Used by a Downstream Component
HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the...
PT-2021-11234
Name of the Vulnerable Software and Affected Versions: HtmlSanitizer versions prior to 5.0.372 Description: The issue allows for a possible XSS bypass if the tag is allowed. An attacker could craft HTML that includes script after passing through the sanitizer if the tag has been explicitly allowe...
Mganss HtmlSanitizer Cross-Site Scripting Vulnerability
Mganss HtmlSanitizer is a C, AngleSharp based software from Mganss Individual Developers for use in clearing HTML code and documents from source code that could lead to XSS attacks. HtmlSanitizer suffers from a cross-site scripting vulnerability, which can be exploited by an attacker to create...
CVE-2026-48760: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
More info at https://symfony.com/cve-2026-48760...
CVE-2026-48760: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
More info at https://symfony.com/cve-2026-48760...
CVE-2026-45064: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
More info at https://symfony.com/cve-2026-45064...
CVE-2026-45064: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
More info at https://symfony.com/cve-2026-45064...