EUVD-2026-64656
GHSA-h7rw-29pr-mcj6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable XSS requiring victim interaction (UI:R), scope change to browser (S:C), low C and I impact on victim session, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling stored or reflected XSS attacks.
AnalysisAI
Cross-site scripting in justhtml before 3.11.0 allows remote unauthenticated attackers to execute arbitrary JavaScript in victims' browsers via SVG or MathML elements injected through selectedcontent projections. The default sanitizer fails to remove event handlers that are cloned and reinserted during the selectedcontent projection process, bypassing the library's intended sanitization guarantees. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application passes user-controlled HTML through justhtml's default sanitizer and renders that output to other users or to the same user in a context where script execution matters. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 5.1) reflects a network-exploitable, low-complexity flaw requiring active user interaction (UI:A), with impact confined to the subsequent system - the victim's browser context - at low confidentiality and integrity levels. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a crafted comment or rich-text field containing an SVG element with an onerror or onload event handler to a web application that uses justhtml for sanitization. The justhtml sanitizer processes the input but fails to strip the event handler when the SVG element passes through a selectedcontent projection clone step. … |
| Remediation | Upgrade justhtml to version 3.11.0 or later, which addresses the event handler bypass in selectedcontent projections per the vendor advisory at https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-gjf2-f4jc-69xf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Uncontrolled recursion in the justhtml Python HTML parsing library (all versions through 1.9.1) allows any remote unauth
Sanitizer bypass in the justhtml Python library (versions <= 1.11.0) allows attacker-controlled input to survive as raw
Cross-site scripting via HTML sanitization bypass affects justhtml (a Python HTML parsing/sanitization library by EmilSt
Sanitization bypass in justhtml (a Python HTML/Markdown sanitization library) before 1.15.0 lets attacker-controlled inp
Uncontrolled resource consumption in justhtml before 1.18.0 enables denial-of-service conditions through CPU and memory
Cross-site scripting in justhtml 0.9.0-1.21.0 allows an attacker who can control the text content of HTML code or pre el
Mutation XSS in justhtml (versions ≤1.11.0) allows injection of arbitrary HTML into serialized output when applications
Mutation XSS (mXSS) in justhtml 1.13.0 and earlier enables markup injection bypass against applications using non-defaul
Cross-site scripting in justhtml versions before 1.13.0 allows attackers who control `<pre>` element content to break ou
Sanitization bypass in justhtml (Python HTML sanitization library) before version 1.17.0 enables cross-site scripting in
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today