justhtml EUVD-2026-64660

Exploitation requires that the target application uses justhtml with a custom sanitization policy that explicitly permits retention of <style> or <script> elements, overriding the default policy which discards their contents. The application must additionally accept attacker-controlled input that ends up as a text node inside one of these permitted elements, and the serialized HTML output must subsequently be rendered in a victim's browser (UI:A - user interaction required). Applications using only the built-in default policy are completely unaffected regardless of version. Limiting factors include: the non-default custom policy requirement, the need for downstream browser rendering of the serialized output, and required user interaction to trigger execution.

The CVSS 4.0 score of 5.1 (Medium) with SC:L/SI:L and UI:A accurately reflects the constrained impact: only the subsequent system (the victim's browser) is affected, with low confidentiality and integrity impact, and user interaction is required to trigger rendering. The critical limiting factor is the non-default configuration prerequisite - applications must explicitly override the default policy to retain style or script elements before this serialization path is reachable, substantially narrowing the realistic attack surface to a subset of justhtml deployments. No KEV listing exists and active exploitation has not been confirmed. EPSS data was not provided in the source intelligence; given the narrow prerequisite, real-world exploitation probability is likely low even among affected deployments. The vulnerability is a genuine concern for any application that uses justhtml with a permissive policy for style or script elements, and upgrading to 1.12.0 should be treated as routine hygiene rather than an emergency response for teams not using such a custom policy.

An attacker submits content containing a text node inside a permitted <style> element with the value </style><img src=x onerror=alert(document.cookie)>. When the application passes the resulting DOM through sanitize_dom() with a custom policy retaining style elements and then renders the serialized string in a browser, the literal </style> closes the style block and the injected img tag executes attacker JavaScript in the victim's browser session. No public exploit code has been identified at time of analysis, but the GHSA advisory exposes source-level detail sufficient to construct a proof of concept.