Description

justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling stored or reflected XSS attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-23T14:16:54.127Z",
  "pubdate": "2026-08-23T14:16:54.127Z",
  "executiveSummary": "A cross-site scripting (XSS) vulnerability exists in justhtml prior to version 3.11.0 within the default sanitizer implementation.\nThe flaw allows attackers to bypass the sanitization mechanism's event handler removal routine specifically within selectedcontent projections.\nThe impact of this vulnerability includes the potential execution of arbitrary JavaScript code in the context of a victim's browser session, facilitating stored or reflected XSS attacks.\nThe affected product is justhtml, specifically versions prior to 3.11.0.\nRisk implications include session hijacking, theft of sensitive user data, and unauthorized manipulation of the Document Object Model (DOM) rendered by the application.\nAttacker capabilities involve crafting malicious input containing specialized markup that evades standard sanitization filtering.\nExploitation requirements include the ability to supply untrusted input containing SVG or MathML elements equipped with embedded event handlers, which are subsequently processed and rendered by the vulnerable sanitizer configuration.",
  "technicalDetails": "The vulnerability resides in the default sanitizer component of justhtml prior to version 3.11.0, specifically within the handling of selectedcontent projections.\nThe root cause stems from a logic flaw in the sanitization pipeline where specific injected elements fail to undergo complete stripping of potentially dangerous attributes.\nSpecifically, attackers can leverage Scalable Vector Graphics (SVG) or Mathematical Markup Language (MathML) elements containing embedded event handlers.\nDuring the parsing and projection phase, these elements are processed, cloned, and reinserted into the final output stream without adequate sanitization, leaving the malicious event handlers intact.\nThe attack flow proceeds as follows: 1) An attacker submits maliciously crafted input containing SVG or MathML nodes configured with active event handlers (such as onload or onerror) targeted at selectedcontent projections. 2) The justhtml parsing engine processes the input through the default sanitizer. 3) Due to the insufficient filtering logic, the sanitizer fails to strip the event handlers from the cloned SVG or MathML elements. 4) The processed output containing the unmitigated payload is reinserted and rendered within the target DOM. 5) When a user interacts with the rendered output or when the element triggers, the embedded event handler executes arbitrary JavaScript within the security context of the victim browser.\nThe vulnerable component is the default sanitizer logic handling selectedcontent projections within justhtml versions before 3.11.0.\nNetwork exposure depends on the application architecture, potentially allowing remote attackers to trigger the vulnerability if untrusted user input is passed directly to the sanitizer without additional validation.\nAuthentication and privilege requirements are contingent on the vulnerable application's implementation, but generally, any unauthenticated or authenticated user capable of injecting crafted markup can trigger the behavior.\nPost-exploitation impact includes persistent or reflected script execution, enabling session compromise, credential theft, and further client-side attacks."
}