GHSA-qvc2-mg72-jjhx

Suggest an improvement
Source
https://github.com/advisories/GHSA-qvc2-mg72-jjhx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-qvc2-mg72-jjhx/GHSA-qvc2-mg72-jjhx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qvc2-mg72-jjhx
Aliases
Published
2026-03-18T20:19:47Z
Modified
2026-08-24T03:56:00Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
JustHTML Affected by Mutation XSS via Literal Text Serialization in Raw Text Elements (style/script)
Details

Summary

Sanitized DOM trees can be unsafe to serialize when a custom policy allows raw-text elements such as <style> or <script>.

The issue affects DOM trees that are constructed or modified programmatically and then passed through sanitize_dom() with a policy that keeps these elements. Text nodes inside <style> and <script> are serialized literally, so attacker-controlled text containing the matching closing tag sequence can break out of the raw-text context and inject HTML into the serialized output.

The default sanitization policy is not affected because it drops the contents of style and script.

Details

The root cause is in HTML serialization of raw-text elements. In serialize.py, text children of script and style are emitted verbatim:

_LITERAL_TEXT_SERIALIZATION_ELEMENTS = frozenset({"script", "style"})

def _serialize_text_for_parent(text: str | None, parent_name: str | None) -> str:
    if not text:
        return ""
    if parent_name in _LITERAL_TEXT_SERIALIZATION_ELEMENTS:
        return text
    return _escape_text(text)
Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-18T20:19:47Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

PyPI / justhtml

Package

Name
justhtml
View open source insights on deps.dev
Purl
pkg:pypi/justhtml

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.12.0

Affected versions

0.*
0.1.0
0.2.0
0.3.0
0.4.0
0.5.0
0.5.1
0.5.2
0.6.0
0.7.0
0.8.0
0.9.0
0.10.0
0.11.0
0.12.0
0.13.0
0.13.1
0.14.0
0.15.0
0.16.0
0.17.0
0.18.0
0.19.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.25.0
0.26.0
0.27.0
0.28.0
0.29.0
0.30.0
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.38.0
0.39.0
0.40.0
1.*
1.0.0
1.1.0
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
1.7.0
1.8.0
1.9.0
1.9.1
1.10.0
1.11.0

Database specific

last_known_affected_version_range 
"<= 1.11.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-qvc2-mg72-jjhx/GHSA-qvc2-mg72-jjhx.json"