justhtml EUVD-2026-64656

Exploitation requires that the target application passes user-controlled HTML through justhtml's default sanitizer and renders that output to other users or to the same user in a context where script execution matters. The specific trigger is the selectedcontent projection code path - meaning the application must exercise the projection feature, either explicitly or as part of default sanitizer behavior. Limiting factors include: active user interaction is required (UI:A per CVSS 4.0), meaning a victim must load or interact with the attacker-influenced page; the attacker-supplied content must include SVG or MathML elements (plain HTML event handlers on standard elements are presumably sanitized correctly); and the application must not apply a secondary sanitization layer after justhtml. Applications that use justhtml solely for server-side rendering without user-supplied input, or that do not render output back to browsers, are not exposed.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 5.1) reflects a network-exploitable, low-complexity flaw requiring active user interaction (UI:A), with impact confined to the subsequent system - the victim's browser context - at low confidentiality and integrity levels. The UI:A requirement is the primary risk limiter: exploitation depends on a victim visiting or interacting with attacker-influenced content. No KEV listing and no identified POC mean this is not confirmed as actively exploited. The real-world risk is meaningful for any web application that uses justhtml as a sanitization boundary and renders user-controlled HTML - stored XSS scenarios (where attacker content persists and is served to many users) carry higher practical risk than reflected scenarios. The low CVSS 4.0 score is appropriate: scope is bounded to browser-side JavaScript execution, and full system compromise is not achievable through this vector alone. EPSS data was not supplied; absent that signal, priority should be driven by whether the application accepts untrusted HTML and exposes it to other users.

An attacker submits a crafted comment or rich-text field containing an SVG element with an onerror or onload event handler to a web application that uses justhtml for sanitization. The justhtml sanitizer processes the input but fails to strip the event handler when the SVG element passes through a selectedcontent projection clone step. The payload is stored in the database or reflected in a response, and when a victim user loads the page, the SVG event handler fires and executes attacker-controlled JavaScript in the victim's browser session, enabling session token theft or UI redress. No public POC has been identified, but the technique (SVG/MathML namespace event handler bypass) is a well-understood XSS class with many prior proof-of-concept patterns available publicly.