CVE-2026-54570

What it is

AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing Consume in AngleSharp/Html/Parser/HtmlDomBuilder.cs to route tokens through foreign-content parsing instead of HTML parsing. A sanitizer can therefore observe a different DOM from the browser that reparses the serialized output. An attacker can combine this namespace differential with markup-breaking characters in an attribute value so that an element hidden from the sanitizer becomes active script-capable HTML after browser reparse, resulting in mutation cross-site scripting. This issue is fixed in version 1.5.0.

At a glance

Exploitability

Can be exploited over the network without logging in, but needs a user to act. High risk of data tampering.

Exploit odds

0.3% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-08-18 18:18 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-18 20:09 UTC Last updatedMost recent change to the record

Details

Published

2026-08-18 18:18 UTC

Last modified

2026-09-18 20:09 UTC

Exploit probability

0.3% · EPSS, next 30 days

Weakness

CWE-80

Record status

Deferred

Attack profile CVSS 3.1 · 6.9

Attack vector

Network

Complexity

High

Privileges needed

None

User interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None