CVE-2026-54570

Name of the Vulnerable Software and Affected Versions AngleSharp versions prior to 1.5.0

Description AngleSharp fails to correctly implement the HTML specification regarding the <annotation-xml> element. When this element has an encoding attribute set to text/html or application/xhtml+xml, it should be treated as an HTML integration point where content is parsed as HTML. Instead, the Consume() function in AngleSharp/Html/Parser/HtmlDomBuilder.cs routes tokens through foreign-content parsing because the MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not assigned the NodeFlags.HtmlTip flag.

Additionally, the WriteAttributeValue() function in AngleSharp/Html/HtmlMarkupFormatter.cs does not escape < or > characters in attribute values. An attacker can exploit this combination to create a namespace differential between AngleSharp and a web browser. By using markup-breaking characters in an attribute value, an attacker can hide malicious elements from a sanitizer that uses AngleSharp, which then become active script-capable HTML after the browser reparses the serialized output, leading to mutation cross-site scripting (mXSS).

Recommendations Update AngleSharp to version 1.5.0.