CVE-2026-74793: justhtml before 3.11.0 XSS via selectedcontent projection
justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling stored or reflected XSS attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
justhtmlto a version that resolves this vulnerability.Fixed in 3.11.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using npm/justhtml versions before 3.11.0 are affected when they process attacker-controlled content through selectedcontent projections. The issue occurs with the default sanitizer.
What does an attacker need to exploit this?
An attacker needs a way to supply content that the application sanitizes and renders through a selectedcontent projection. They can use SVG or MathML elements containing event handlers, which may be cloned and reinserted without sanitization.
How can I determine whether my application is vulnerable?
Check whether your dependency version of npm/justhtml is earlier than 3.11.0. Also review uses of selectedcontent projections that handle untrusted input, especially where SVG or MathML markup could be accepted.