Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-7808: Justhtml Sanitization Flaw Affects Programmatic DOM Input
CVE-2026-7808 · published 11 days ago
Summary
The justhtml library versions 1.15.0 and earlier contain multiple security flaws that can allow malicious code to bypass sanitization. These flaws can occur when using custom policies or programmatic DOM input, potentially allowing attackers to inject malicious content or execute unauthorized actions. Update to version 1.16.0 to address these issues.
What to do
- Update justhtml to version 1.16.0.
- Update emilstenstrom justhtml to version 1.16.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | – | justhtml |
<= 1.15.0 Fix: upgrade to 1.16.0
|
| – | emilstenstrom | justhtml | < 1.16.0 |
Original advisory text
justhtml before 1.16.0 Multiple Security Issues via Sanitization
justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML(..., sanitize=True) path for ordinary parsed HTML: mutating or reusing sanitization policy objects (including exported defaults) could weaken later sanitization; programmatic DOM input to sanitize()/sanitize_dom() could miss mixed-case tag names (e.g., ScRiPt, StYlE); crafted programmatic doctype names could serialize into active markup; and custom policies preserving SVG or MathML could allow animation elements, presentation attributes with external url(...) references, or DOM trees mislabeled as namespace="html" to bypass foreign-content checks. Fixed in 1.16.0.
References
- https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-4p64-v8f5-r2g...
- https://github.com/advisories/GHSA-4p64-v8f5-r2gx
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7808.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-7808 Vendor Advisory
- https://www.vulncheck.com/advisories/justhtml-before-multiple-security-issues-vi... Vendor Advisory
Severity
9.9
Critical
CVSS 4.0: 1.3 (GHSA)
CVSS 3.1: 9.8 (NVD)
CVSS 4.0: 9.3 (NVD)
Exploitation
EPSS <1%
Type
CWE-79Cross-site Scripting (XSS)
CWE-178Improper Handling of Case Sensitivity
CWE-436Interpretation Conflict
CWE-471Modification of Assumed-Immutable Data (MAID)
CWE-20Improper Input Validation
Timeline
Published23 Aug 2026
Updated2 Sep 2026
First seen14 Apr 2026
Monitor software like this
Free during beta