A flaw in the AngleSharp library allows a MathAnnotationXmlElement to be treated as a foreign-content element rather than an HTML integration point when its encoding attribute is text/html or application/xhtml+xml. As a result, the library’s parsing routine processes certain tokens through foreign‑content parsing instead of normal HTML parsing. This divergence creates a condition where a sanitizer can see a different DOM than the browser does after recomposition, enabling an attacker to embed markup that bypasses the sanitizer. The attacker can combine this namespace mismatch with markup‑breaking characters embedded in an attribute value to create an element that is invisible to the sanitizer but becomes a legitimate, script‑capable element when the browser reparses it, yielding a mutation cross‑site scripting vulnerability.

The vulnerability affects the AngleSharp .NET library for versions older than 1.5.0. Vendors and developers using AngleSharp to parse user provided HTML or MathML before the 1.5.0 release are impacted. The issue is fixed and no longer present in the 1.5.0 release and later.

The CVSS score is 6.9, indicating a moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The likely exploitation scenario involves an application that parses input through AngleSharp and can supply specially crafted markup. While the exploit does not rely on remote code execution, it can compromise confidentiality and integrity by executing malicious scripts in the client’s context. The moderate score reflects the limited scope of the vulnerability and the requirement that the application processes untrusted content with AngleSharp.