CVE-2026-8630: justhtml before 1.12.0 Mutation XSS via Raw Text Elements
justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in the serialization of raw-text elements such as <style> and <script>. When a DOM tree is processed by sanitizedom() using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the raw-text context and inject arbitrary HTML into the serialized output. The default sanitization policy is not affected because it drops the contents of style and script.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
justhtmlto a version that resolves this vulnerability.Fixed in 1.12.0
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using justhtml versions 1.11.0 or earlier are affected only if sanitize_dom() is called with a custom policy that preserves raw-text elements such as style or script. The default sanitization policy is not affected because it drops those elements and their contents.
What must an attacker control to exploit this issue?
An attacker needs to supply text that is placed inside a preserved raw-text element and includes that element's matching closing-tag sequence. During serialization, the text is emitted without escaping, allowing it to terminate the raw-text context and inject HTML into the output.
How can I determine whether my application is exposed?
Review uses of sanitize_dom() and the custom policies passed to it. Exposure exists where a policy retains style, script, or other raw-text elements while attacker-controlled content can become a text node inside those elements.