Skip to main content

justhtml EUVDEUVD-2026-64654

| CVE-2026-5751 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-08-23 VulnCheck GHSA-3227-3f97-9f2q
XSS Justhtml
5.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.7 MEDIUM

AC:H reflects the non-default custom policy prerequisite beyond attacker control; scope changes to browser context (S:C) with bounded C:L/I:L XSS impact; UI:R because victim must load the page.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 23, 2026 - 14:18 vuln.today
Analysis Generated
Aug 23, 2026 - 14:18 vuln.today
Patch available
Aug 23, 2026 - 14:01 EUVD

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 pypi packages depend on justhtml (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.13.0.

DescriptionCVE.org

justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vulnerability when using a custom SanitizationPolicy that preserves foreign namespaces (e.g., drop_foreign_namespaces=False with allowlisted SVG/MathML elements or raw-text containers such as <style>). Specially crafted input can sanitize into markup that appears safe but becomes unsafe when re-parsed by a browser or another HTML parser, allowing markup injection. The default safe configuration (sanitize=True) is not affected. Fixed in 1.14.0.

AnalysisAI

Mutation XSS (mXSS) in justhtml 1.13.0 and earlier enables markup injection bypass against applications using non-default custom SanitizationPolicy configurations that preserve foreign namespaces. Specially crafted input sanitizes to apparently clean markup that is subsequently reinterpreted as executable script when re-parsed by a browser - a classic parser-differential attack. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft parser-differential SVG/MathML payload
Delivery
Submit to app via form or API
Exploit
justhtml custom policy passes mutated markup as safe
Execution
Sanitized output stored or reflected in page
Persist
Victim browser re-parses foreign-namespace subtree
Impact
XSS executes in victim browser session
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the target application to use justhtml with a custom SanitizationPolicy that explicitly sets drop_foreign_namespaces=False AND either allowlists SVG or MathML elements, or allowlists raw-text containers such as <style>. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) reflects a network-reachable, unauthenticated attack requiring active user interaction, with impact scoped to the subsequent browser context (SC:L/SI:L) rather than the server itself. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker targeting an application that renders user-supplied HTML through justhtml with a custom foreign-namespace policy (e.g., a rich-text editor supporting SVG) submits a carefully crafted payload - for example, nested SVG or MathML elements with script-bearing attributes - that justhtml's parser evaluates as benign and passes. When another authenticated user's browser loads the sanitized output and its HTML5 parser re-serializes the foreign-namespace subtree, the markup mutates into an active script node, executing attacker-controlled JavaScript in the victim's session context. …
Remediation Upgrade justhtml to version 1.14.0, available via pip (pip install --upgrade justhtml). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Justhtml

View all
CVE-2026-9769 HIGH POC
8.7 Aug 23

Uncontrolled recursion in the justhtml Python HTML parsing library (all versions through 1.9.1) allows any remote unauth
CVE-2026-8445 CRITICAL
9.3 Aug 23

Sanitizer bypass in the justhtml Python library (versions <= 1.11.0) allows attacker-controlled input to survive as raw

CVE-2026-7808 CRITICAL
9.3 Aug 23

Cross-site scripting via HTML sanitization bypass affects justhtml (a Python HTML parsing/sanitization library by EmilSt
CVE-2026-5388 CRITICAL
9.3 Aug 23

Sanitization bypass in justhtml (a Python HTML/Markdown sanitization library) before 1.15.0 lets attacker-controlled inp
CVE-2026-4671 HIGH
8.7 Aug 23

Uncontrolled resource consumption in justhtml before 1.18.0 enables denial-of-service conditions through CPU and memory

CVE-2026-77088 MEDIUM
5.3 Aug 23

Cross-site scripting in justhtml 0.9.0-1.21.0 allows an attacker who can control the text content of HTML code or pre el
CVE-2026-74793 MEDIUM
5.1 Aug 23

Cross-site scripting in justhtml before 3.11.0 allows remote unauthenticated attackers to execute arbitrary JavaScript i
CVE-2026-8630 MEDIUM
5.1 Aug 23

Mutation XSS in justhtml (versions ≤1.11.0) allows injection of arbitrary HTML into serialized output when applications

CVE-2026-5389 MEDIUM
5.1 Aug 23

Cross-site scripting in justhtml versions before 1.13.0 allows attackers who control `<pre>` element content to break ou
CVE-2026-6827 MEDIUM
5.1 Aug 23

Sanitization bypass in justhtml (Python HTML sanitization library) before version 1.17.0 enables cross-site scripting in

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

EUVD-2026-64654 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy