justhtml CVE-2026-5751

Exploitation requires the target application to use justhtml with a custom SanitizationPolicy that explicitly sets drop_foreign_namespaces=False AND either allowlists SVG or MathML elements, or allowlists raw-text containers such as <style>. Applications using the default JustHTML(sanitize=True) configuration are confirmed unaffected. What limits exploitation: the attacker has no network-level authentication barrier (PR:N), but the necessary non-default configuration must have been deliberately chosen by the application developer; a victim user must also actively load or interact with the page containing the mutated markup (UI:A required). Server-side or filesystem access is not required, and the impact is bounded to the victim's browser session - server integrity and confidentiality are not directly affected.

The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) reflects a network-reachable, unauthenticated attack requiring active user interaction, with impact scoped to the subsequent browser context (SC:L/SI:L) rather than the server itself. The score's use of AT:N warrants scrutiny: the vulnerability is conditional on the application being deliberately configured with a non-default custom policy that preserves foreign namespaces - a prerequisite that, in CVSS 4.0 terms, arguably justifies AT:P (attack requirements present), which would further lower the score. This is therefore a realistic but genuinely narrow risk: only applications that have consciously opted into custom foreign-namespace policies are exposed. The exploitation is not automated (UI:A) and impact is bounded to browser-side confidentiality and integrity, not server compromise. No CISA KEV listing and no POC code were identified, so exploitation appears theoretical rather than observed. For affected deployments the risk is real - successful XSS can lead to session hijacking or credential theft - but the default-configuration exclusion significantly reduces the affected population.

An attacker targeting an application that renders user-supplied HTML through justhtml with a custom foreign-namespace policy (e.g., a rich-text editor supporting SVG) submits a carefully crafted payload - for example, nested SVG or MathML elements with script-bearing attributes - that justhtml's parser evaluates as benign and passes. When another authenticated user's browser loads the sanitized output and its HTML5 parser re-serializes the foreign-namespace subtree, the markup mutates into an active script node, executing attacker-controlled JavaScript in the victim's session context. No public POC has been identified at time of analysis, but the mXSS technique is well-documented and the mutation primitive is reproducible given knowledge of the specific parser differential.