CVE-2026-5751: justhtml before 1.14.0 Mutation XSS via custom sanitization policies
justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vulnerability when using a custom SanitizationPolicy that preserves foreign namespaces (e.g., dropforeignnamespaces=False with allowlisted SVG/MathML elements or raw-text containers such as <style>). Specially crafted input can sanitize into markup that appears safe but becomes unsafe when re-parsed by a browser or another HTML parser, allowing markup injection. The default safe configuration (sanitize=True) is not affected. Fixed in 1.14.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
justhtmlto a version that resolves this vulnerability.Fixed in 1.14.0 - Configuration
Avoid parser-differential/mutation XSS by not preserving foreign namespaces in a custom SanitizationPolicy; for example, set drop_foreign_namespaces=True instead of drop_foreign_namespaces=False (the vulnerable configuration described for justhtml <= 1.13.0).
justhtml SanitizationPolicy drop_foreign_namespaces = true
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use justhtml 1.13.0 or earlier with a custom SanitizationPolicy that preserves foreign namespaces, such as drop_foreign_namespaces=False, together with allowlisted SVG/MathML elements or raw-text containers like <style>. The default sanitize=True configuration is not affected.
What does an attacker need to exploit this issue?
An attacker needs to supply specially crafted HTML that is processed by an affected custom sanitization policy. Exploitation relies on the sanitized output later being re-parsed by a browser or another HTML parser, where parser differences can turn apparently safe markup into injected markup.
What should teams do if they use a custom sanitization policy?
Upgrade to justhtml 1.14.0. Until upgrading, avoid policies that preserve foreign namespaces and avoid allowlisting SVG, MathML, or raw-text containers such as <style> for untrusted input.