CVE-2026-6827: justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnerabilities
justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces (SVG/MathML), dangerous content such as HTML integration points (SVG <foreignObject>, MathML <annotation-xml encoding="text/html">) and mutation-XSS parser-differential payloads could survive sanitization and become active HTML after reparse; SVG filter="url(...)" and preserved <style> could leave resource-loading CSS (@import, background-image:url()). Programmatic script/style/Comment nodes could serialize into active markup. Additional hardening fixes address sanitize-pipeline cache mutation and DOM parent/child cycles that could cause infinite loops. Most issues affect advanced or custom configurations rather than the default JustHTML(..., sanitize=True) safe path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
justhtmlto a version that resolves this vulnerability.Fixed in 1.17.0 - Compensating control
If you rely on custom sanitize policies, avoid preserving foreign namespaces (SVG/MathML). Specifically prevent/disable dangerous HTML integration points such as SVG <foreignObject> and MathML <annotation-xml encoding="text/html">, and avoid payloads that rely on mutation-XSS parser differentials surviving sanitization/reparse.
- Compensating control
If you rely on custom sanitizer policy that preserves SVG/MathML content, also block SVG resource-loading vectors such as filter attributes using URL syntax (e.g., filter="url(...)") and preserved <style> contents that could include CSS resource-loading like @import and background-image:url().
- Compensating control
For advanced/custom configurations that use programmatic DOM nodes (e.g., script/style/Comment nodes), ensure those node types are not allowed to serialize into active markup; otherwise reject/strip these nodes before any serialization/reparse that could activate previously sanitized content.
Event History
Frequently Asked Questions
Is the default sanitization path affected?
Most of the issues affect advanced or custom configurations rather than the default JustHTML(..., sanitize=True) safe path.
Which configurations are most exposed?
Configurations that preserve foreign namespaces such as SVG or MathML are exposed to dangerous integration points and mutation-XSS parser differentials. Policies that preserve SVG filter attributes or style elements may also allow resource-loading CSS, including @import and background-image:url().
What conditions can make sanitized content become active markup?
Dangerous content can survive sanitization when SVG foreignObject or MathML annotation-xml with encoding="text/html" is preserved, then become active HTML after reparsing. Programmatically created script, style, or Comment nodes can also serialize into active markup.
What other effects should be considered besides XSS?
The affected versions also have sanitize-pipeline cache mutation and DOM parent/child cycle issues. DOM cycles can cause infinite loops.