CVE-2026-7808
Received Received - Intake

HTML Sanitization Bypass in justhtml

Publication date: 2026-08-23

Last updated on: 2026-08-23

Assigner: VulnCheck

Description
justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML(..., sanitize=True) path for ordinary parsed HTML: mutating or reusing sanitization policy objects (including exported defaults) could weaken later sanitization; programmatic DOM input to sanitize()/sanitize_dom() could miss mixed-case tag names (e.g., ScRiPt, StYlE); crafted programmatic doctype names could serialize into active markup; and custom policies preserving SVG or MathML could allow animation elements, presentation attributes with external url(...) references, or DOM trees mislabeled as namespace="html" to bypass foreign-content checks. Fixed in 1.16.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-23
Last Modified
2026-08-23
Generated
2026-08-23
AI Q&A
2026-08-23
EPSS Evaluated
N/A
NVD
CVE-2026-7808
EUVD
EUVD-2026-64658

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
justhtml justhtml 1.16.0
emilstenstrom justhtml 1.16.0
emilstenstrom justhtml to 1.16.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-7808 affects justhtml versions before 1.16.0 with multiple HTML sanitization bypass flaws. These issues allow dangerous content like scripts or styles to evade sanitization, potentially leading to cross-site scripting (XSS) attacks. The vulnerabilities primarily impact advanced usage scenarios rather than default safe HTML parsing.

Detection Guidance

To detect this vulnerability, check the installed version of justhtml using commands like 'npm list justhtml' or 'pip show justhtml'. If the version is below 1.16.0, the system is vulnerable. Review custom sanitization policies for mutations or reuse of default objects. Inspect DOM sanitization processes for mixed-case tag handling and doctype serialization.

Impact Analysis

This vulnerability could allow attackers to inject malicious scripts or styles into web pages, leading to XSS attacks. If exploited, it may compromise user data, session tokens, or perform unauthorized actions on behalf of users. Systems using justhtml for sanitizing untrusted HTML input are at risk.

Compliance Impact

This vulnerability could lead to cross-site scripting (XSS) attacks by allowing malicious scripts or styles to bypass HTML sanitization. This may violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., Security Rule safeguards for integrity and confidentiality) by enabling unauthorized code execution that could exfiltrate sensitive user data or manipulate content.

Mitigation Strategies

Immediately upgrade justhtml to version 1.16.0 or later. Avoid mutating default sanitization policies or reusing modified policy objects. Disable preservation of SVG/MathML elements for untrusted input. Refrain from serializing untrusted programmatic doctypes or DOM trees. Temporarily disable advanced sanitization features if upgrade is delayed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7808. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart