Security Advisory

CVE-2026-5751

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-23 13:34:10

Last updated 2026-08-23 13:34:10

Assigner VulnCheck

CVSS score 6.1

State PUBLISHED

Description

justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vulnerability when using a custom SanitizationPolicy that preserves foreign namespaces (e.g., drop_foreign_namespaces=False with allowlisted SVG/MathML elements or raw-text containers such as <style>). Specially crafted input can sanitize into markup that appears safe but becomes unsafe when re-parsed by a browser or another HTML parser, allowing markup injection. The default safe configuration (sanitize=True) is not affected. Fixed in 1.14.0.

← Browse all CVEs View on cve.org ↗