Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

anglesharp

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.9NuGetPublished

    AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass

    CVE-2026-54570 · GHSA-pgww-w46g-26qg

    Affected
    • NuGet anglesharp < 1.5.0
    Fixed in
    1.5.0· Vendor fix available
    Issue
    The HTML specification requires that a MathML <annotation-xml element with encoding="text/html" or encoding="application/xhtml+xml" is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML. AngleSharp does not implement this correctly. As a result, the parser produces a DOM tree that differs from what a browser will build (different namespaces if encoding="text/html" is not treated) when given the same serialized output. Two bugs combine to make this exploitable: - Missing HtmlTip flag: MathAnnotationXmlElement is never assigned NodeFlags.HtmlTip based on its encoding attribute, so the Consume() dispatch always routes tokens to Foreign() instead of Home() (HTML mode). - Unescaped < in attribute values: HtmlMarkupFormatter.WriteAttributeValue() does not escape < or characters, only & and ". This allows injected markup to break out of attribute values on re-parse. See Escape "<" and "" in attributes when serializing HTML #6235 Details In…

    Recommended action: Upgrade to 1.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →