CVE-2026-54570: 
C# vulnerability analysis and mitigation

CVE-2026-54570 is a mutation XSS (mXSS) vulnerability in AngleSharp, a .NET HTML5 parsing library, caused by incorrect handling of the MathML <annotation-xml> HTML integration point. Two compounding bugs allow an attacker to craft input that AngleSharp's parser treats as safe, but which a browser re-parses as executable script. It affects all AngleSharp NuGet versions prior to 1.5.0 (specifically ≤ 1.4.1). The vulnerability was first published by maintainer FlorianRappl on June 6, 2026, and added to the GitHub Advisory Database on July 17, 2026. It carries a CVSS v3.1 base score of 6.9 (Medium) (GitHub Advisory, AngleSharp Advisory).

The vulnerability is classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page). Two distinct bugs combine to enable exploitation: (1) MathAnnotationXmlElement is never assigned the NodeFlags.HtmlTip flag based on its encoding attribute, so the parser's Consume() dispatch always routes tokens to Foreign() (MathML mode) instead of Home() (HTML mode), even when encoding="text/html" or encoding="application/xhtml+xml" is present — violating the HTML specification's requirement to treat such elements as HTML integration points; (2) HtmlMarkupFormatter.WriteAttributeValue() escapes &, ", and non-breaking spaces but does not escape < or > in attribute values, allowing injected markup to break out of attribute context during re-serialization. The compensating check in ForeignNormalTag() is also bypassed entirely during fragment parsing (the innerHTML setter) due to an if (!IsFragmentCase) guard. A public proof-of-concept is included in the advisory, demonstrating that a sanitizer walking AngleSharp's DOM sees no dangerous elements, yet the serialized output triggers script execution when re-parsed by a browser (GitHub Advisory, AngleSharp Advisory).

The primary impact is a bypass of HTML sanitizers that rely on AngleSharp for safe HTML parsing. An attacker can supply crafted input containing a MathML <annotation-xml encoding="text/html"> payload with unescaped </> in attribute values; AngleSharp's DOM will appear clean to a sanitizer, but the serialized output — when rendered by a browser — will execute arbitrary JavaScript (e.g., via <img onerror=...> or similar event handlers). This enables cross-site scripting (XSS) attacks against end users of applications that use AngleSharp-based sanitization, with potential for session hijacking, credential theft, and unauthorized actions performed in the victim's browser context. The scope is changed (attacker impacts resources beyond the vulnerable component), confidentiality impact is low, and integrity impact is high (GitHub Advisory).

1. Identify target: Locate a web application that accepts user-supplied HTML, sanitizes it using an AngleSharp-based sanitizer (version ≤ 1.4.1), and then renders the sanitized output to other users.
2. Craft mXSS payload: Construct an HTML payload using a MathML <annotation-xml encoding="text/html"> element containing an attribute value with unescaped < and > characters, embedding a script-triggering element such as <img onerror=alert(1)> inside the attribute value.
3. Submit payload: Submit the crafted HTML through the application's input mechanism (e.g., a comment field, profile bio, or rich-text editor).
4. Sanitizer bypass: AngleSharp parses the input and builds a DOM that does not contain the injected <img> element (it is hidden inside an attribute value in MathML namespace), so the sanitizer finds nothing dangerous and passes the content.
5. Serialization and re-parse: AngleSharp serializes the DOM back to HTML; because < and > are not escaped in attribute values, the output string contains raw markup that breaks out of the attribute context.
6. Browser execution: When a victim's browser receives and parses the serialized output, it correctly treats annotation-xml encoding="text/html" as an HTML integration point, causing the injected element (e.g., <img onerror=...>) to be instantiated and the event handler to execute arbitrary JavaScript (GitHub Advisory, AngleSharp Advisory).

• Network: HTTP requests containing MathML annotation-xml elements with encoding="text/html" or encoding="application/xhtml+xml" attributes in POST body or URL parameters; responses containing raw unescaped < or > characters inside HTML attribute values in rendered content.
• Logs: Application logs showing submission of HTML content containing <annotation-xml or <math tags from user input fields; server-side HTML sanitization logs (if present) showing content passed as clean that contains MathML structures.
• Browser/Client-Side: Unexpected JavaScript execution (e.g., alert dialogs, network requests to attacker-controlled domains) triggered by onerror, onload, or similar event handlers on image or other elements in pages that display user-generated content.
• File System: If the application stores sanitized HTML, stored content files or database records containing <annotation-xml with encoding="text/html" alongside attribute values with raw </> characters.

Upgrade AngleSharp (NuGet package) to version 1.5.0 or later, which fixes the vulnerability by correctly assigning NodeFlags.HtmlTip to MathAnnotationXmlElement based on its encoding attribute and by escaping < and > in HtmlMarkupFormatter.WriteAttributeValue(). No configuration-based workaround is available for the parser bug itself; applications that cannot upgrade immediately should consider using an alternative HTML sanitization library or adding a secondary validation layer that rejects input containing <annotation-xml with HTML-encoding attributes. Developers using AngleSharp as a sanitization backend should treat its output as untrusted until upgraded (AngleSharp Release 1.5.0, GitHub Advisory).

The vulnerability was reported by security researcher internetpestcontrol and published by AngleSharp maintainer FlorianRappl on June 6, 2026. The advisory was added to the GitHub Advisory Database on July 17, 2026. No significant broader media coverage or notable social media discussion has been identified at this time (GitHub Advisory).