2026-02-03 — HtmlSanitizer bypass via <template> tag (GHSA-j92c-7v7g-gj3f)¶

What happened: HtmlSanitizer had an XSS sanitization bypass involving the <template> tag.

Why it matters: HTML sanitizers are notoriously hard to get right; bypasses often appear via: - overlooked elements (template, svg, math) - parser differentials between sanitizer and browser - attribute/namespace edge-cases

Durable guidance (defensive)¶

1. Prefer context-aware output encoding over sanitization

2. If you can render as text, do that.

3. If you must accept rich HTML:

4. Use a well-maintained sanitizer and keep it updated.

5. Apply a strict allowlist (tags + attributes) and ban high-risk elements (script, style, template, svg, math).

6. Backstop with CSP

7. Content-Security-Policy with script-src nonces/hashes reduces exploitability.

8. Test bypasses in real browsers

9. Add regression tests with known payloads.

References¶

• GitHub Advisory Database: https://github.com/advisories/GHSA-j92c-7v7g-gj3f

Consolidation note¶

This is the canonical page for this topic. During the 2026-05-22 redundancy pass, overlapping pages were reduced to compatibility pointers:

• alerts/2026-02-05-htmlsanitizer-template-tag-bypass-ghsa-j92c-7v7g-gj3f.md