CVE-2026-74793
Received Received - Intake

Cross-Site Scripting in justhtml via SVG/MathML Event Handlers

Publication date: 2026-08-23

Last updated on: 2026-08-23

Assigner: VulnCheck

Description
justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling stored or reflected XSS attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-23
Last Modified
2026-08-23
Generated
2026-08-23
AI Q&A
2026-08-23
EPSS Evaluated
N/A
NVD
CVE-2026-74793
EUVD
EUVD-2026-64656

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
justhtml justhtml to 3.11.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) flaw in justhtml versions before 3.11.0. The default sanitizer fails to remove event handlers from SVG or MathML elements in selectedcontent projections. Attackers can inject malicious code that gets cloned and reinserted without sanitization, enabling stored or reflected XSS attacks.

Detection Guidance

To detect this vulnerability, check if your system uses justhtml versions prior to 3.11.0. Inspect installed packages with commands like 'npm list justhtml' or 'pip show justhtml'. Review code for use of selectedcontent projections that may allow event handler injection.

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in a user's browser when they interact with affected web pages. It can lead to theft of sensitive data, session hijacking, or defacement of websites. Users of applications built with vulnerable justhtml versions are at risk.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Immediately upgrade justhtml to version 3.11.0 or later. If upgrading is not possible, review and sanitize all user inputs, especially those processed through selectedcontent projections. Remove or disable SVG/MathML elements with event handlers in output.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74793. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart