CVE-2026-8630
Received Received - Intake

Mutation XSS in JustHTML

Publication date: 2026-08-23

Last updated on: 2026-08-23

Assigner: VulnCheck

Description
justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in the serialization of raw-text elements such as <style> and <script>. When a DOM tree is processed by sanitize_dom() using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the raw-text context and inject arbitrary HTML into the serialized output. The default sanitization policy is not affected because it drops the contents of style and script.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-23
Last Modified
2026-08-23
Generated
2026-08-23
AI Q&A
2026-08-23
EPSS Evaluated
N/A
NVD
CVE-2026-8630
EUVD
EUVD-2026-64660

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
justhtml justhtml to 1.12.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-8630 is a mutation cross-site scripting (mXSS) vulnerability in the justhtml library affecting versions 1.11.0 and earlier. It occurs when sanitized DOM trees containing raw-text elements like style or script are serialized. If a custom sanitization policy allows these elements, text nodes inside them are serialized without escaping. Attackers can inject malicious HTML by including closing tag sequences, breaking out of the raw-text context.

Detection Guidance

To detect this vulnerability, inspect systems using justhtml versions 1.11.0 or earlier. Check for custom sanitization policies that retain raw-text elements like style or script. Review serialized DOM outputs for improperly escaped text nodes in these elements.

Impact Analysis

This vulnerability allows attackers to inject malicious HTML or JavaScript into web pages processed by justhtml. If exploited, it could lead to unauthorized actions on behalf of users, data theft, or defacement of web content. Users relying on custom sanitization policies that retain style or script elements are at risk.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, which may violate GDPR or HIPAA requirements for data protection and security. Organizations using affected versions of justhtml with custom policies retaining raw-text elements may face compliance risks if exploited.

Mitigation Strategies

Upgrade justhtml to version 1.12.0 or later. If using a custom sanitization policy, ensure it removes or properly escapes content within style and script elements. Avoid retaining raw-text elements unless absolutely necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8630. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart