GHSA-r758-8hxw-4845
Suggest an improvement- Source
- https://github.com/advisories/GHSA-r758-8hxw-4845
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-r758-8hxw-4845/GHSA-r758-8hxw-4845.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-r758-8hxw-4845
- Aliases
- Published
- 2026-04-08T00:06:17Z
- Modified
- 2026-08-24T03:55:59Z
- Severity
-
- 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- justhtml: Mutation XSS with custom foreign-namespace sanitization policies
- Details
-
Summary
A parser-differential / mutation XSS issue was found in
justhtmlwhen using a custom sanitization policy that preserves foreign namespaces such as SVG or MathML.Under these custom settings, specially crafted input could sanitize into HTML that looked safe at first, but became unsafe when parsed again by a browser or another HTML parser.
Impact
This issue does not affect the default safe configuration.
You may be affected if you use a custom
SanitizationPolicywith settings like:drop_foreign_namespaces=False- allowlisted foreign elements such as MathML or SVG
- allowlisted raw-text containers such as
<style>
In that case, an attacker could inject markup that survives sanitization and turns into active HTML after re-parsing.
Affected versions
justhtml<= 1.13.0
Fixed version
- Fixed in
1.14.0
Workarounds
Until you upgrade:
- keep
drop_foreign_namespaces=True - avoid allowlisting foreign namespaces for untrusted input
- avoid allowlisting raw-text containers such as
<style>in custom policies
Notes
The default
JustHTML(..., sanitize=True)behavior was not found to be vulnerable in this issue.Credit
Discovered by JustHTML author during a LLM-based security review of
justhtml. - Database specific
{ "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2026-04-08T00:06:17Z", "nvd_published_at": null, "severity": "LOW" }- References
Affected packages
PyPI / justhtml
Package
- Name
- justhtml
- View open source insights on deps.dev
- Purl
- pkg:pypi/justhtml