CVE-2026-54570: 
C# vulnerability analysis and mitigation

CVE-2026-54570 is a mutation cross-site scripting (mXSS) vulnerability in AngleSharp, a .NET library for parsing HTML, MathML, SVG, and XML. The flaw arises from AngleSharp's non-compliant handling of the annotation-xml MathML element as an HTML integration point, causing a DOM mismatch between AngleSharp's parser and browsers that can be exploited to bypass HTML sanitizers. All versions prior to 1.5.0 (≤ 1.4.1) are affected. The vulnerability was published by maintainer FlorianRappl on June 6, 2026, and added to the GitHub Advisory Database on July 17, 2026. It carries a CVSS v3.1 base score of 6.9 (Medium) (Github Advisory).

Two distinct bugs combine to make this vulnerability exploitable (CWE-80). First, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is never assigned the NodeFlags.HtmlTip flag based on its encoding attribute, so the Consume() dispatch in HtmlDomBuilder.cs always routes tokens through foreign-content parsing (Foreign()) instead of HTML parsing (Home()), even when encoding="text/html" or encoding="application/xhtml+xml" is present — contrary to the HTML5 specification. Second, HtmlMarkupFormatter.WriteAttributeValue() fails to escape < and > characters in attribute values (only &, ", and   are escaped), allowing injected markup to break out of attribute context during re-serialization. An attacker crafts a payload using <math><annotation-xml encoding="text/html"> with markup-breaking characters in an attribute value; AngleSharp's sanitizer sees a benign DOM, but when the serialized output is re-parsed by a browser (which correctly treats annotation-xml encoding="text/html" as an HTML integration point), the hidden element becomes active script-capable HTML, triggering mXSS. A public PoC is included in the security advisory (Github Advisory, AngleSharp Advisory).

Successful exploitation allows an attacker to bypass HTML sanitizers built on top of AngleSharp, injecting and executing arbitrary JavaScript in a victim's browser context after the sanitized content is re-parsed. The primary impact is high integrity loss (script execution, DOM manipulation, session hijacking, credential theft) with low confidentiality impact (data accessible to the injected script). Availability is not affected. The scope change (S:C) indicates that the impact extends beyond the vulnerable component itself to the user's browser session and any data accessible within it (Github Advisory).

A proof-of-concept (PoC) is publicly available in the GitHub Security Advisory and was classified as poc exploitation status by NVD SSVC. The vulnerability is not automatable (requires user interaction — a victim must load the attacker-controlled, sanitizer-processed content in a browser). No in-the-wild exploitation or threat actor attribution has been reported. The EPSS score is approximately 0.246% (16th percentile), indicating a low near-term exploitation probability. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Identify target: Locate a web application that uses AngleSharp (≤ 1.4.1) as an HTML sanitizer to process and re-render user-supplied content (e.g., a comment system, rich-text editor, or content management platform).
2. Craft mXSS payload: Construct a payload exploiting the annotation-xml HTML integration point bypass. Example structure:

   <math><annotation-xml encoding="text/html"><title>">&lt;img src=x onerror=alert(1)&gt;</title></annotation-xml></math>

   The < and > characters in the attribute value are not escaped by AngleSharp's serializer, allowing markup breakout on re-parse.
3. Submit payload: Inject the crafted payload into any input field processed by the AngleSharp-based sanitizer (e.g., a form submission, API endpoint accepting HTML).
4. Sanitizer bypass: AngleSharp parses the payload and routes content inside annotation-xml through foreign-content parsing (MathML mode), so the injected <img> element is invisible to the sanitizer's DOM walk — the sanitizer passes the content as safe.
5. Browser re-parse triggers mXSS: When the serialized (sanitized) output is delivered to a victim's browser, the browser correctly treats annotation-xml encoding="text/html" as an HTML integration point, re-parses the content as HTML, and the <img onerror=...> element becomes active, executing the attacker's JavaScript in the victim's browser context.
6. Achieve objective: The executed script can steal session cookies, perform actions on behalf of the victim, exfiltrate sensitive data, or redirect the user to a malicious site (Github Advisory, AngleSharp Advisory).

• Network: HTTP requests containing annotation-xml with encoding="text/html" or encoding="application/xhtml+xml" attributes combined with unescaped < or > characters in attribute values submitted to input endpoints.
• Logs: Web application logs showing submissions with MathML annotation-xml elements and embedded HTML markup (e.g., <img, <script, onerror=) within attribute values; WAF alerts on MathML-based XSS patterns.
• Browser/Client-Side: Unexpected JavaScript execution (e.g., alert(), fetch() to external domains) triggered by onerror or similar event handlers on image or other elements in pages rendering AngleSharp-sanitized content.
• File System: If the application persists sanitized content to a database or files, stored entries containing <math><annotation-xml encoding="text/html"> with embedded HTML tags in attribute values may indicate prior exploitation attempts.

Upgrade AngleSharp to version 1.5.0 (released June 6, 2026), which fixes both the missing NodeFlags.HtmlTip assignment for annotation-xml elements with HTML encoding attributes and the unescaped </> characters in HtmlMarkupFormatter.WriteAttributeValue(). The fix is available on NuGet. No official configuration-based workaround exists for the vulnerable versions; the only reliable remediation is upgrading. Applications using AngleSharp as a security-critical HTML sanitizer should treat this as a high-priority update (Github Advisory, AngleSharp Release).

The vulnerability was reported by security researcher internetpestcontrol and published by AngleSharp maintainer FlorianRappl. The advisory notes that this flaw reduces AngleSharp's credibility as a conformant HTML5 parser, particularly for security-sensitive use cases such as HTML sanitization. No significant broader media coverage or notable social media discussion has been identified beyond the GitHub advisory (AngleSharp Advisory).