CVE-2026-5751 PUBLISHED

justhtml before 1.14.0 Mutation XSS via custom sanitization policies

Assigner: VulnCheck
Reserved: 07.04.2026 Published: 23.08.2026 Updated: 23.08.2026

justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vulnerability when using a custom SanitizationPolicy that preserves foreign namespaces (e.g., drop_foreign_namespaces=False with allowlisted SVG/MathML elements or raw-text containers such as <style>). Specially crafted input can sanitize into markup that appears safe but becomes unsafe when re-parsed by a browser or another HTML parser, allowing markup injection. The default safe configuration (sanitize=True) is not affected. Fixed in 1.14.0.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS Score: 5.1

Product Status

Vendor EmilStenstrom
Product justhtml
Versions Default: unaffected
  • affected from 0 to 1.14.0 (excl.)
  • Version 1.14.0 is unaffected

Credits

  • EmilStenstrom coordinator

References

Problem Types

  • Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE