CVE-2023-44390 — HtmlSanitizer is a

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability occurs in configurations where foreign content is allowed, i.e. either `svg` or `math` are in the list of allowed elements. In the case an app

01What is this vulnerability?

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability occurs in configurations where foreign content is allowed, i.e. either `svg` or `math` are in the list of allowed elements. In the case an application sanitizes user input with a vulnerable configuration, an attacker could bypass the sanitization and inject…

02Affected products

Vendor	Product	Versions
mganss	HtmlSanitizer	< 8.0.723, >= 8.1.0-beta, < 8.1.722-beta

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

• Published: 2023-10-05T13:41:20.387Z
• Last modified: 2024-09-19T17:32:06.969Z

09References

• github.com — https://github.com/mganss/HtmlSanitizer/security/advisories/GHSA-43cp-6p3q-2pc4
• github.com — https://github.com/mganss/HtmlSanitizer/commit/ab29319866c020f0cc11e6b92228cd803…