GHSA-pgww-w46g-26qg: AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass

Summary The HTML specification requires that a MathML <annotation-xml> element with encoding="text/html" or encoding="application/xhtml+xml" is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML. AngleSharp does not implement this correctly. As a result, the parser produces a DOM tree that differs from what a browser will build (different namespaces if encoding="text/html" is not treated) when given the same serialized output. Two bugs combine to make this exploitable: - Missing HtmlTip flag: MathAnnotationXmlElement is never assigned NodeFlags.HtmlTip based on its encoding attribute, so the Consume() dispatch always routes tokens to Foreign() instead of Home() (HTML mode). - Unescaped < > in attribute values: HtmlMarkupFormatter.WriteAttributeValue() does not escape < or > characters, only & and ". This allows injected markup to break out of attribute values on re-parse. _See Escape "<" and ">" in attributes when serializing HTML #6235 _ Details In MathAnnotationXmlElement (AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs): // Current — HtmlTip is never set : base(owner, TagNames.AnnotationXml, prefix, NodeFlags.Special | NodeFlags.Scoped) Because HtmlTip is absent, the token dispatch in Consume() always sends tokens to Foreign() when inside annotation-xml, regardless of the encoding attribute. The compensating check in ForeignNormalTag() only covers tags in AllForeignExceptions and is entirely bypassed during fragment parsing (innerHTML setter) due to an if (!IsFragmentCase) guard. In HtmlMarkupFormatter.WriteAttributeValue() (AngleSharp/Html/HtmlMarkupFormatter.cs): // Escapes & " and \u00A0, but NOT < or > case Symbols.Ampersand: stringBuilder.Append("&"); break; case Symbols.NoBreakSpace: stringBuilder.Append(" "); break; case Symbols.DoubleQuote: stringBuilder.Append("""); break; default: stringBuilder.Append(value[i]); break; // < and > pass through raw PoC The following program demonstrates that Angle