CVE-2026-6827: justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnerabilities

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-23 · updated 2026-10-12
Weakness: CWE-79

Description

justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces (SVG/MathML), dangerous content such as HTML integration points (SVG <foreignObject>, MathML <annotation-xml encoding="text/html">) and mutation-XSS parser-differential payloads could survive sanitization and become active HTML after reparse; SVG filter="url(...)" and preserved <style> could leave resource-loading CSS (@import, background-image:url()). Programmatic script/style/Comment nodes could serialize into active markup. Additional hardening fixes address sanitize-pipeline cache mutation and DOM parent/child cycles that could cause infinite loops. Most issues affect advanced or custom configurations rather than the default JustHTML(..., sanitize=True) safe path.

Affected products

EmilStenstrom justhtml: before 1.17.0 — fixed in 1.17.0

How to fix

Upgrade to a fixed version: EmilStenstrom justhtml 1.17.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-6827 or the next vulnerability affects your stack