Description

AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing Consume in AngleSharp/Html/Parser/HtmlDomBuilder.cs to route tokens through foreign-content parsing instead of HTML parsing. A sanitizer can therefore observe a different DOM from the browser that reparses the serialized output. An attacker can combine this namespace differential with markup-breaking characters in an attribute value so that an element hidden from the sanitizer becomes active script-capable HTML after browser reparse, resulting in mutation cross-site scripting. This issue is fixed in version 1.5.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.9",
  "pubDate": "2026-08-18T18:18:23.310Z",
  "pubdate": "2026-08-18T18:18:23.310Z",
  "executiveSummary": "AngleSharp prior to version 1.5.0 contains a vulnerability involving namespace handling and DOM construction that can lead to mutation cross-site scripting (mXSS).\nThe vulnerability occurs because MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is improperly handled and not treated as an HTML integration point when its encoding attribute is set to text/html or application/xhtml+xml.\nThis causes the Consume function in AngleSharp/Html/Parser/HtmlDomBuilder.cs to route tokens incorrectly through foreign-content parsing rather than standard HTML parsing.\nConsequently, an HTML sanitizer utilizing the library may construct a DOM tree that differs significantly from the DOM tree produced by a browser that reparses the serialized output.\nAn attacker can exploit this namespace differential by combining it with markup-breaking characters within attribute values.\nThis allows an element that was hidden or neutralized by the sanitizer to become active, script-capable HTML after being reparsed by a target browser, ultimately leading to cross-site scripting execution.\nThe risk is particularly significant for web applications using AngleSharp as a server-side HTML sanitizer to filter untrusted user input before rendering it to clients.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper classification of MathAnnotationXmlElement within the AngleSharp parsing engine, specifically located in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs.\nAccording to HTML parsing specifications, specific elements under foreign content namespaces act as HTML integration points when designated attributes—such as encoding with values like text/html or application/xhtml+xml—are present, instructing the parser to switch back to HTML parsing rules.\nPrior to version 1.5.0, AngleSharp fails to recognize MathAnnotationXmlElement as an HTML integration point under these conditions.\nAs a result, the Consume function within AngleSharp/Html/Parser/HtmlDomBuilder.cs continues to route tokens through foreign-content parsing rules instead of reverting to standard HTML parsing.\nThis parser state discrepancy creates a divergence between the Document Object Model (DOM) evaluated by the AngleSharp-based sanitizer and the DOM constructed by a standard web browser when reparsing the subsequently serialized HTML output.\nThe step-by-step exploitation flow involves an attacker supplying maliciously crafted input containing a MathML annotation element with an encoding attribute specifying text/html or application/xhtml+xml, alongside carefully crafted markup-breaking characters embedded inside attribute values.\nBecause the AngleSharp parser processes the node under foreign-content rules, the sanitizer fails to neutralize the malicious payload properly, resulting in a sanitized output string that passes security checks.\nWhen the victim browser receives and reparses this serialized output, the browser correctly identifies the element as an HTML integration point and parses the internal payload using standard HTML rules.\nThe markup-breaking characters prematurely close attributes and tags, transforming previously inert data into active, script-capable HTML structures such as executing JavaScript via event handlers or script tags.\nThis behavior achieves mutation cross-site scripting (mXSS), bypassing the application's sanitization layer entirely without requiring authentication or elevated privileges, provided the application processes untrusted markup with affected versions of AngleSharp."
}