justhtml CVE-2026-6827

Exploitation of the primary XSS vectors requires the target application to use justhtml with a custom sanitization policy that explicitly preserves SVG or MathML foreign namespace elements (overriding the default deny behavior), or to preserve <style> elements for untrusted HTML input. Applications using only the default JustHTML(..., sanitize=True) configuration without custom foreign-namespace or <style> policies are explicitly confirmed by the vendor to be unaffected by most issues. The programmatic DOM serialization issue additionally requires the application to construct or mutate DOM trees directly in code (using justhtml's node APIs) before calling to_html() or to_markdown(html_passthrough=True). Exploitation is further constrained by the requirement for a victim user to load or view the rendered output in a browser (UI:A per the CVSS 4.0 vector), meaning server-side-only processing that never renders to a browser is not affected by the XSS impact. The cache mutation issue requires repeated sanitization passes on the same pipeline instance to degrade security over time.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 5.1) reflects a network-reachable XSS affecting only the subsequent system (end-user browser), with user interaction required (UI:A) and no direct impact on the server-side vulnerable component (VC/VI/VA all N). The score of 5.1 is consistent with medium severity. EPSS data was not provided in the source intelligence, limiting probabilistic exploitation forecasting. This CVE does not appear in the CISA KEV catalog and no public proof-of-concept exploit code was identified, reducing immediate exploitation urgency. Critically, the vendor and GHSA advisory explicitly confirm that the default JustHTML(..., sanitize=True) configuration is not affected by most issues - the real risk is concentrated in applications using non-default custom policies that preserve SVG/MathML namespaces or <style> elements, or those performing direct programmatic DOM construction. The SVG filter="url(...)" and CSS resource-loading issues introduce a secondary risk vector (server-side request forgery or data exfiltration via CSS) beyond pure XSS. The cache mutation finding is lower severity but could silently degrade security posture over time. Overall, real-world risk is low for applications using default configurations and medium for those with custom foreign-namespace policies exposed to untrusted input.

An attacker submits a crafted HTML fragment containing a mutation-XSS payload that uses an SVG <foreignObject> or MathML <annotation-xml encoding="text/html"> integration point to an application that calls justhtml with a custom policy permitting foreign namespaces (for example, a content platform allowing rich media embeds). The payload appears inert in justhtml's internal DOM and passes sanitization, but when the application renders the sanitized output in a user's browser, the HTML5 parser re-enters HTML content model at the integration point boundary, activating embedded JavaScript. No public proof-of-concept code has been identified, but the mXSS technique is well-documented in public research and skilled attackers familiar with parser-differential payloads could construct one from the advisory description alone.