CVE-2026-25543: 
C# vulnerability analysis and mitigation

CVE-2026-25543 is a Cross-Site Scripting (XSS) bypass vulnerability in HtmlSanitizer, a .NET library used to clean HTML fragments and documents to prevent XSS attacks. When the <template> tag is explicitly allowed by the application configuration, its contents are not sanitized, enabling attackers to inject malicious scripts. Affected versions are all releases prior to 9.0.892 (stable) and prior to 9.1.893-beta (beta channel, starting from 9.1.878). The vulnerability was published on February 4, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is improper sanitization of the <template> HTML element's content (CWE-79: Cross-site Scripting; CWE-116: Improper Encoding or Escaping of Output). The <template> tag is special in that browsers do not normally render its contents — however, two bypass paths exist. First, a mutation XSS technique exploits Chromium-based browsers' DOM node depth limit of 512: nesting at least 509 opening tags before a <template> causes the browser to flatten the DOM, effectively "popping out" unsanitized content from within the template and rendering it. Second, if the application also allows the shadowrootmode attribute (via sanitizer.AllowedAttributes.Add("shadowrootmode")), a simple payload like <template shadowrootmode="open"><script>alert('xss')</script></template> bypasses the sanitizer entirely, as the shadow root causes the template contents to be rendered. The fix modifies DoSanitize() to recursively sanitize the IDocumentFragment content of any IHtmlTemplateElement encountered (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on any application that relies on HtmlSanitizer for HTML safety and has explicitly allowed the <template> tag. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the user, and defacement of web content. The confidentiality and integrity of user data are at risk, though availability is not directly impacted. The scope is changed (cross-origin), meaning the injected script can affect resources beyond the vulnerable application's immediate context (GitHub Advisory).

1. Reconnaissance: Identify web applications built on .NET that use HtmlSanitizer versions prior to 9.0.892 or 9.1.893-beta and that accept user-supplied HTML input (e.g., rich text editors, comment fields, profile pages).
2. Confirm template tag allowance: Test whether the application passes <template> tags through the sanitizer by submitting a benign <template> payload and observing whether it is preserved in the output HTML.
3. Mutation XSS via depth limit (no shadowrootmode required): Craft a payload consisting of at least 509 nested opening tags followed by <template><script>alert('xss')</script></template>. When the browser's DOM parser hits the 512-node depth limit, it flattens the structure, causing the unsanitized <script> inside the template to be rendered.
4. Shadow DOM bypass (if shadowrootmode is allowed): If the application also permits the shadowrootmode attribute, submit the simpler payload: <div><template shadowrootmode="open"><script>alert('xss')</script></template></div>. The shadow root causes the template contents to render immediately.
5. Deliver payload to victim: Embed the crafted payload in any user-controlled field that is stored or reflected and later rendered in another user's browser (stored XSS) or via a crafted link (reflected XSS).
6. Achieve objective: The injected script executes in the victim's browser, enabling session token theft, credential harvesting, keylogging, or further attacks (GitHub Advisory).

• Logs: Web server or application logs showing requests containing deeply nested HTML tags (500+ opening tags) or <template> elements with shadowrootmode attributes in user-submitted fields; unusual JavaScript payloads (e.g., alert, fetch, document.cookie) embedded within <template> tags in stored content.
• File System / Database: Stored HTML content in the database containing <template> tags with nested <script> blocks or event handlers, particularly with shadowrootmode="open" or shadowrootmode="closed" attributes.
• Network: Outbound requests from victim browsers to attacker-controlled domains (e.g., for cookie exfiltration) originating from pages that render user-supplied HTML; unexpected POST requests carrying session tokens or credentials to external endpoints.
• Application Behavior: Reports from users of unexpected JavaScript dialogs, redirects, or unauthorized actions occurring on pages that display user-generated content.

Upgrade HtmlSanitizer to version 9.0.892 (stable) or 9.1.893-beta (beta), which patch the vulnerability by recursively sanitizing the content of <template> elements (GitHub Advisory, NuGet 9.0.892). As a workaround for those unable to upgrade immediately, ensure the <template> tag is not added to the allowed tags list — it is disallowed by default, so only custom configurations that explicitly call sanitizer.AllowedTags.Add("template") are affected. Additionally, avoid allowing the shadowrootmode attribute in sanitizer configurations. Prioritize patching any application that accepts and renders user-supplied HTML with a non-default HtmlSanitizer configuration.

The vulnerability was discovered and reported by security researcher nsysean, who is credited in the official GitHub Security Advisory (GitHub Advisory). The maintainer (mganss) responded promptly, publishing the advisory and patch on February 3–4, 2026. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation.