Description

justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces (SVG/MathML), dangerous content such as HTML integration points (SVG <foreignObject>, MathML <annotation-xml encoding="text/html">) and mutation-XSS parser-differential payloads could survive sanitization and become active HTML after reparse; SVG filter="url(...)" and preserved <style> could leave resource-loading CSS (@import, background-image:url()). Programmatic script/style/Comment nodes could serialize into active markup. Additional hardening fixes address sanitize-pipeline cache mutation and DOM parent/child cycles that could cause infinite loops. Most issues affect advanced or custom configurations rather than the default JustHTML(..., sanitize=True) safe path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-23T14:16:53.963Z",
  "pubdate": "2026-08-23T14:16:53.963Z",
  "executiveSummary": "The justhtml package before version 1.17.0 contains multiple security vulnerabilities related to sanitization, serialization, and programmatic Document Object Model (DOM) handling.\nThe primary vulnerabilities involve improper neutralization of input during web page generation, specifically affecting custom sanitization policies that preserve foreign namespaces such as SVG and MathML.\nImpacts include potential cross-site scripting (XSS), mutation-XSS parser-differential attacks, unauthorized resource loading via cascading style sheets, and denial of service conditions caused by infinite loops from DOM parent-child cycles.\nThe affected product is justhtml in versions prior to 1.17.0.\nWhile the default safe path using JustHTML with sanitize=True mitigates most risks, advanced or custom configurations enabling foreign namespaces or programmatic node manipulation expose applications to these security issues.\nAttackers capable of supplying crafted input to applications utilizing custom insecure policies can achieve arbitrary script execution or trigger denial of service.",
  "technicalDetails": "The root cause of these vulnerabilities stems from incomplete sanitization logic and insecure handling of advanced DOM structures within justhtml prior to version 1.17.0.\nWhen custom policies preserve foreign namespaces like SVG and MathML, dangerous content such as HTML integration points including SVG foreignObject and MathML annotation-xml encoding=text/html can survive the sanitization process.\nThis surviving content can subsequently become active HTML markup when reparsed by a browser, facilitating mutation-XSS and parser-differential payloads.\nAdditionally, preserved SVG filter attributes utilizing url(...) schemes and retained style elements can lead to unintended resource loading via CSS mechanisms such as @import and background-image:url().\nProgrammatic handling of script, style, and Comment nodes allows them to incorrectly serialize into active markup.\nFurther technical issues include sanitize-pipeline cache mutation vulnerabilities and DOM parent-child cycles that fail to check for circular references, resulting in infinite execution loops and denial of service.\nStep-by-step attack flow involves an attacker supplying malicious HTML containing targeted foreign namespace integration points, CSS resource-loading directives, or cyclic DOM structures to an application relying on custom justhtml policies.\nThe sanitization engine fails to strip the dangerous constructs due to overly permissive custom policies or flawed node serialization.\nUpon rendering or reprocessing the output, the payload executes in the context of the victim's browser session or exhausts computational resources."
}