CVE-2026-116538 mganss CVE debrief

Who should care

Defenders responsible for applications using HtmlSanitizer should assess exposure and prioritize verification and remediation efforts. This includes reviewing application code, verifying HtmlSanitizer versions, and ensuring proper sanitization of user input. Additionally, defenders should consider the potential operational impacts of this vulnerability, including the risk of script execution and potential for attackers to supply malicious input.

Why it matters

Defenders should prioritize verifying exposure in applications using HtmlSanitizer versions before 9.2.1039 or 10.0.1037-beta, and assess the risk of script execution when rendering serialized document or body outer HTML.

• Script execution when rendering serialized document or body outer HTML
• Potential for attackers to supply malicious input
• Need for verification of HtmlSanitizer version and exposure

Technical summary

The vulnerability exists in HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta, allowing attackers to supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML. This issue arises from the incomplete sanitization process of the SanitizeDom function, which fails to properly address attributes on the html and body elements. As a result, defenders should prioritize verifying exposure in applications using HtmlSanitizer versions before 9.2.1039 or 10.0.1037-beta, and assess the risk of script execution when rendering serialized document or body outer HTML.

Defensive priority

Defenders should prioritize verifying exposure in applications using HtmlSanitizer versions before 9.2.1039 or 10.0.1037-beta, and assess the risk of script execution when rendering serialized document or body outer HTML.

Recommended defensive actions

• Verify HtmlSanitizer version and update to 9.2.1039 or later if possible
• Assess exposure in applications using HtmlSanitizer
• Review and update application code to ensure proper sanitization of user input
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected versions and a description of the issue. The vulnerability exists in HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta. The source item and CVE record provide evidence of the vulnerability and its impact. However, additional verification is required to assess the full scope of affected systems and potential operational impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.