EUVD-2026-64660
GHSA-rc3v-3cc7-h7h5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because exploitation requires a non-default custom policy retaining style/script elements; S:C and UI:R reflect browser-side XSS impact requiring victim interaction.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in the serialization of raw-text elements such as <style> and <script>. When a DOM tree is processed by sanitize_dom() using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the raw-text context and inject arbitrary HTML into the serialized output. The default sanitization policy is not affected because it drops the contents of style and script.
AnalysisAI
Mutation XSS in justhtml (versions ≤1.11.0) allows injection of arbitrary HTML into serialized output when applications use a custom sanitization policy that retains raw-text elements such as <style> or <script>. Attacker-controlled text node content containing a closing tag sequence causes the serializer to break out of the raw-text context, inserting attacker-supplied markup into the final HTML string rendered by a victim's browser. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses justhtml with a custom sanitization policy that explicitly permits retention of <style> or <script> elements, overriding the default policy which discards their contents. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 (Medium) with SC:L/SI:L and UI:A accurately reflects the constrained impact: only the subsequent system (the victim's browser) is affected, with low confidentiality and integrity impact, and user interaction is required to trigger rendering. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits content containing a text node inside a permitted <style> element with the value </style><img src=x onerror=alert(document.cookie)>. When the application passes the resulting DOM through sanitize_dom() with a custom policy retaining style elements and then renders the serialized string in a browser, the literal </style> closes the style block and the injected img tag executes attacker JavaScript in the victim's browser session. … |
| Remediation | Upgrade justhtml to version 1.12.0, which contains the vendor-released patch confirmed by GitHub Security Advisory GHSA-qvc2-mg72-jjhx (https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-qvc2-mg72-jjhx) and the VulnCheck advisory (https://www.vulncheck.com/advisories/justhtml-before-mutation-xss-via-raw-text-elements). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Uncontrolled recursion in the justhtml Python HTML parsing library (all versions through 1.9.1) allows any remote unauth
Sanitizer bypass in the justhtml Python library (versions <= 1.11.0) allows attacker-controlled input to survive as raw
Cross-site scripting via HTML sanitization bypass affects justhtml (a Python HTML parsing/sanitization library by EmilSt
Sanitization bypass in justhtml (a Python HTML/Markdown sanitization library) before 1.15.0 lets attacker-controlled inp
Uncontrolled resource consumption in justhtml before 1.18.0 enables denial-of-service conditions through CPU and memory
Cross-site scripting in justhtml 0.9.0-1.21.0 allows an attacker who can control the text content of HTML code or pre el
Cross-site scripting in justhtml before 3.11.0 allows remote unauthenticated attackers to execute arbitrary JavaScript i
Mutation XSS (mXSS) in justhtml 1.13.0 and earlier enables markup injection bypass against applications using non-defaul
Cross-site scripting in justhtml versions before 1.13.0 allows attackers who control `<pre>` element content to break ou
Sanitization bypass in justhtml (Python HTML sanitization library) before version 1.17.0 enables cross-site scripting in
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today