{"action":"Upgrade HtmlSanitizer to 9.0.892 (9.0.x) or 9.1.893-beta (9.1.x) or later.","affected":[{"fixed":"9.0.892","introduced":"0"},{"fixed":"9.1.893-beta","introduced":"9.1.878-beta"}],"component":"HtmlSanitizer","cve_ids":["CVE-2026-25543"],"ecosystem":"NuGet","epss":0.00278,"exploited":false,"fixed_versions":["9.0.892","9.1.893-beta"],"ghsa_id":"GHSA-j92c-7v7g-gj3f","id":"tcs_01M5N8S4FN1P93TDVM96VBM1WH","modified_at":"2026-02-28T06:26:27.846949Z","published_at":"2026-02-03T19:22:06Z","references":["https://osv.dev/vulnerability/GHSA-j92c-7v7g-gj3f","https://github.com/mganss/HtmlSanitizer/security/advisories/GHSA-j92c-7v7g-gj3f","https://nvd.nist.gov/vuln/detail/CVE-2026-25543","https://github.com/mganss/HtmlSanitizer/commit/0ac53dca30ddad963f2b243669a5066933d82b81","https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template","https://github.com/mganss/HtmlSanitizer","https://github.com/mganss/HtmlSanitizer/releases/tag/v9.0.892","https://www.nuget.org/packages/HtmlSanitizer/9.0.892","https://www.nuget.org/packages/HtmlSanitizer/9.1.893-beta"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-j92c-7v7g-gj3f","url":"https://osv.dev/vulnerability/GHSA-j92c-7v7g-gj3f"},{"source":"nvd","source_id":"CVE-2026-25543","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25543"}],"summary":"HtmlSanitizer has a bypass via template tag"}