CVE-2026-97045
NoneCVSS
—
EPSS
0.2%
Published
Oct 27, 2026
CISA due date
—
Cloudanix analysis
A parsing mistake lets specially crafted markup slip through as executable code instead of being safely treated as plain text.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Moderate
- Impact
- Remote Code Execution
- Component
- Library
- Class
- XSS
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Incorrect early termination of ancestor chain walking in childTextNodesAreLiteral allows a foster-parented element in a foreign namespace to bypass HTML integration point checks, causing subtree re-parsing to resolve text nodes into an unintended namespace and emit unsanitized literal content.
Why it matters to the business
Attackers can inject executable scripts into rendered output, leading to session hijacking, data theft, or defacement in any application relying on the affected parser for user-supplied markup.
How an attack unfolds
An attacker supplies markup containing foster-parented elements such as mglyph or malignmark under mtext; the flawed ancestor walk stops at an intervening integration point, emits the subtree as literal text in the wrong namespace, and the re-parsed result executes attacker-controlled scripts.
How to fix it
Update the parser implementation to continue walking the full ancestor chain and verify every non-empty namespace transition occurs at a true HTML integration point before emitting literal text; re-test all foreign namespace and foster-parenting code paths.
How to confirm the fix worked
Review unit tests covering foster-parenting, mtext integration points, and multi-namespace ancestor chains; confirm the corrected walk now reaches the root or an explicit integration point for every literal-text decision.
Typical attack path
- Craft input containing foster-parented foreign elements nested under an HTML integration point
- Trigger tree walk in childTextNodesAreLiteral
- Force incorrect namespace resolution on re-parsing of emitted literal text
- Deliver resulting markup to victim browser for script execution
How to detect it
Search web application or proxy logs for rendered output containing unexpected mglyph, malignmark, or mtext elements followed by script tags; inspect any re-parsed HTML fragments that originate from user-controlled foreign-namespace content.
What your security team should do
- Prioritize upgrade of the affected parser library once a fixed release is available
- Add runtime input sanitization that strips or escapes foster-parented foreign elements
- Monitor downstream dependents for adoption of the corrected version
The record
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|