CVE-2026-54570: AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass

The HTML specification requires that a MathML <annotation-xml> element with encoding="text/html" or encoding="application/xhtml+xml" is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML.

AngleSharp does not implement this correctly. As a result, the parser produces a DOM tree that differs from what a browser will build (different namespaces if encoding="text/html" is not treated) when given the same serialized output. Two bugs combine to make this exploitable:

• Missing HtmlTip flag: MathAnnotationXmlElement is never assigned NodeFlags.HtmlTip based on its encoding attribute, so the Consume() dispatch always routes tokens to Foreign() instead of Home() (HTML mode).
• Unescaped < > in attribute values: HtmlMarkupFormatter.WriteAttributeValue() does not escape < or > characters, only & and “. This allows injected markup to break out of attribute values on re-parse. See Escape “<” and “>” in attributes when serializing HTML #6235