The vulnerability in HtmlSanitizer allows an attacker to insert malicious event handler attributes on nested <body> or <html> tags that are not stripped during the SanitizeDom process. When such sanitized content is rendered or its outer HTML is serialized, the injected handlers execute arbitrary JavaScript in the victim’s browser. This enables script execution within the context of the site, which can lead to session hijacking, credential theft, or defacement. The flaw is a classic injection weakness (CWE‑79) and is commonly used for XSS attacks in web applications that render user‑supplied markup.

The flaw exists in the mganss:HtmlSanitizer library for versions prior to 9.2.1039 and for 10.0 prereleases before 10.0.1037‑beta. Any project that references these releases and uses the SanitizeDom method to wrap user content is susceptible.

The CVSS base score of 2.3 reflects a low‑severity risk under the current scoring model, but the exploit is trivial once the affected method is used. Because the attack vector relies on providing crafted HTML to the sanitizer, any application that accepts unchecked user input and serializes it back to the browser is at risk. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The likely attack path is an application receiving malicious markup, passing it through SanitizeDom, and rendering the result, at which point the injected event handlers fire in the victim’s browser.