justhtml EUVD-2026-64658

Exploitation is not against the default configuration: the specific prerequisites are (1) use of a custom policy that preserves SVG or MathML foreign namespaces, enabling animation elements (<set>, <animate>), presentation attributes (fill, clip-path, mask, marker-start, cursor) with external url(...) references, or DOM trees mislabeled namespace="html"; (2) passing programmatic DOM to sanitize()/sanitize_dom(), which can miss mixed-case tags (ScRiPt, StYlE) or drop_content_tags sets like {"SCRIPT"}; (3) code that mutates or reuses sanitization policy objects, including exported defaults (DEFAULT_POLICY, DEFAULT_DOCUMENT_POLICY), leaving stale compiled sanitizers active - this one CAN affect the otherwise-default path; or (4) custom policies preserving style/script (remote @import) or crafted programmatic doctype names. Limiting factors: the ordinary JustHTML(..., sanitize=True) path on parsed HTML is largely unaffected; XSS payloads still require a victim to render the mis-sanitized output; and most vectors require the application to have opted into advanced/custom sanitization configurations.

The input CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC:H/VI:H/VA:H, score 9.3) reads as trivially remote and unauthenticated with high impact, but this overstates real-world risk for the typical integrator: the description and vendor GHSA state most bypasses do NOT affect the default JustHTML(..., sanitize=True) path and instead require advanced usage - programmatic DOM input, custom SVG/MathML-preserving policies, or code that mutates reused/exported policy objects. That is a meaningful mismatch: AC:L/PR:N/UI:N implies default-config, no-interaction exploitation, whereas the actual conditions are configuration-dependent and, for XSS, ultimately require a victim to view the mis-sanitized content. The genuinely default-affecting subset is the policy-mutation issue (mutating DEFAULT_POLICY/DEFAULT_DOCUMENT_POLICY or nested state process-wide). There is no EPSS score provided, no KEV listing, and no POC referenced, so exploitation is not confirmed in any form; the reporting is credible (VulnCheck) and a fix exists. Net: treat as a real but moderate priority driven by whether your deployment uses the advanced paths - upgrade promptly if you sanitize programmatic DOM, use custom foreign-namespace policies, or reuse/mutate policy objects; lower urgency if you use only the default parsed-HTML sanitization path.

An application uses justhtml <= 1.15.0 with a custom policy that preserves inline SVG for user-submitted content; an attacker submits SVG containing an <animate> element or a presentation attribute with an external url(...) reference that survives sanitization, and when another user views the page the active content executes in their browser session. Alternatively, an app feeding programmatic DOM to sanitize() is bypassed by a mixed-case <ScRiPt> node. No public POC is referenced in the source data.