HtmlSanitizer is a .NET library designed to sanitize HTML fragments. The vulnerability allows an attacker to inject malicious content inside a template tag that is not sanitized when the tag is permitted. Because the template tag can contain executable markup that becomes visible only when the shadowrootmode attribute is set to open or closed, an attacker can trigger a cross‑site scripting attack. This flaw is rooted in improper input validation (CWE‑79) and improper encoding (CWE‑116).

The flaw affects the HtmlSanitizer project from mganss. Versions before 9.0.892 and before 9.1.893‑beta are vulnerable. Any .NET application that references the vulnerable NuGet packages or includes the library in its code base is at risk. The vulnerability is present only when the template tag is explicitly enabled and the shadowrootmode attribute is not correctly restricted.

The CVSS score of 6.3 indicates a medium severity potential compromise of confidentiality and integrity through client‑side code execution. The EPSS probability is less than 1%, suggesting exploitation is unlikely but still possible in targeted attacks. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector would be a client‑side injection via a malicious web page that includes the library, so it requires the application to process untrusted input. Because the flaw resides in content rendering logic, an attacker must have a way to supply material that is parsed by HtmlSanitizer.