Most recent entries from all

EUVD-2026-355193

fkie_cve-2026-54570

AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing Consume in AngleSharp/Html/Parser/HtmlDomBuilder.cs to route tokens through foreign-content parsing instead of HTML parsing. A sanitizer can therefore observe a different DOM from the browser that reparses the serialized output. An attacker can combine this namespace differential with markup-breaking characters in an attribute value so that an element hidden from the sanitizer becomes active script-capable HTML after browser reparse, resulting in mutation cross-site scripting. This issue is fixed in version 1.5.0.

GHSA-pgww-w46g-26qg — AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass

Affected: NuGet: AngleSharp

### Summary The HTML specification requires that a MathML `<annotation-xml>` element with `encoding="text/html"` or `encoding="application/xhtml+xml"` is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML.

AngleSharp does not implement this correctly. As a result, the parser produces a DOM tree that differs from what a browser will build (different namespaces if `encoding="text/html"` is not treated) when given the same serialized output. Two bugs combine to make this exploitable:

- Missing HtmlTip flag: MathAnnotationXmlElement is never assigned NodeFlags.HtmlTip based on its encoding attribute, so the Consume() dispatch always routes tokens to Foreign() instead of Home() (HTML mode). - Unescaped < > in attribute values: HtmlMarkupFormatter.WriteAttributeValue() does not escape < or > characters, only & and ". This allows injected markup to break out of attribute values on re-parse. _See [Escape "<" and ">" in attributes when serializing HTML #6235 ](https://github.com/whatwg/html/issues/6235)_

### Details In `MathAnnotationXmlElement` (`AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs`): ```cs // Current — HtmlTip is never set : base(owner, TagNames.AnnotationXml, prefix, NodeFlags.Special | NodeFlags.Scoped) ```

Because `HtmlTip` is absent, the token dispatch in `Consume()` always sends tokens to `Foreign()` when inside `annotation-xml`, regardless of the encoding attribute. The compensating check in `ForeignNormalTag…