AIKIDO-2026-349873
HtmlSanitizer is vulnerable to Cross-Site Scripting (XSS)
59
Medium Risk
This Affects:
HtmlSanitizerTL;DR
The SanitizeDom method parses the input into a full HTML document and sanitizes only the descendants of the body element, leaving the parsed <html>, <head>, and <body> wrapper elements themselves unscreened. Because HTML5 tree construction merges the attributes of an <html> or <body> start tag in the input onto these wrapper elements, event-handler attributes such as onload supplied in the input survive on the returned document. Callers that serialize more of the document than the body's child nodes then emit live handlers, enabling cross-site scripting. The fix strips all attributes from the wrapper elements before sanitizing and routes each removal through the normal attribute-removal path.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the SanitizeDom method and serialize more of the returned document than the body's child nodes.
Background info
HtmlSanitizer is vulnerable to Cross-Site Scripting (XSS) in versions 4.0.210 - 9.2.995.
How to fix this
Upgrade the HtmlSanitizer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.