Summary The HTML specification requires that a MathML <annotation-xml> element with encoding="text/html" or encoding="application/xhtml+xml" is treated as an HTML integration point. Content inside it must be parsed as H…
| CVE ID | CVE-2026-54570 |
| Vendor | Unknown Vendor |
| Affected Product | Unknown Product |
| Vulnerability Type | Security Vulnerability |
| CVSS Score | 6.9 (MEDIUM) |
| Actively Exploited | ✅ Yes |
| Patch Status | Pending Vendor Disclosure |
| Reported By | CYBERDUDEBIVASH SENTINEL APEX Intelligence (via sentinel_apex) |
#
The HTML specification requires that a MathML <annotation-xml> element with encoding="text/html" or encoding="application/xhtml+xml" is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML.
AngleSharp does not implement this correctly. As a result, the parser produces a DOM tree that differs from what a browser will build (different namespaces if encoding="text/html" is not treated) when given the same serialized output. Two bugs combine to make this exploitable:
Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.