Description

justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in the serialization of raw-text elements such as <style> and <script>. When a DOM tree is processed by sanitize_dom() using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the raw-text context and inject arbitrary HTML into the serialized output. The default sanitization policy is not affected because it drops the contents of style and script.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-23T14:16:55.127Z",
  "pubdate": "2026-08-23T14:16:55.127Z",
  "executiveSummary": "A mutation cross-site scripting (mXSS) vulnerability exists in justhtml prior to version 1.12.0 (versions <= 1.11.0), specifically within the serialization of raw-text elements such as <style> and <script>. When utilizing the sanitize_dom() function with a custom sanitization policy that preserves these raw-text elements, text nodes contained within them are serialized literally without undergoing proper output escaping.\nThis security flaw allows an attacker capable of supplying controlled text containing matching closing tag sequences to prematurely break out of the raw-text context. Consequently, arbitrary HTML injection is achieved in the serialized output, leading to potential mXSS execution within downstream contexts that consume the sanitized output.\nThe default sanitization policy remains unaffected by this vulnerability because it natively drops the contents of <style> and <script> elements. Risk implications are therefore limited to deployments implementing custom sanitization policies that explicitly retain raw-text elements.\nExploitation requires the attacker to inject payloads containing specific tag breakouts into inputs processed by vulnerable versions of justhtml under custom policy configurations.",
  "technicalDetails": "The root cause of the vulnerability lies in the serialization logic of raw-text elements within justhtml. When the DOM tree is processed by the sanitize_dom() function, text nodes residing inside elements like <style> and <script> are handled without applying necessary contextual escape procedures during serialization.\nUnder default operating conditions, justhtml mitigates potential script injection risks by dropping the contents of style and script elements entirely. However, when custom sanitization policies are applied to retain these raw-text elements, the serialization mechanism fails to sanitize or escape the inner text nodes properly.\nThe attack flow proceeds as follows: First, an attacker supplies malicious input containing a crafted payload designed to target raw-text elements, embedding a premature closing tag sequence (such as </style> or </script>) followed by arbitrary HTML or JavaScript vectors. Second, the target application processes this input using justhtml via sanitize_dom() under a custom policy that permits the retention of <style> or <script> tags. Third, because the serialization implementation does not escape the internal text node contents, the embedded closing tag sequence successfully breaks out of the raw-text container context. Finally, the injected markup is treated as active HTML/DOM structures by the downstream renderer, resulting in mutation cross-site scripting (mXSS).\nThe vulnerable component is the serialization mechanism handling raw-text elements within justhtml versions <= 1.11.0. Affected versions include all releases prior to 1.12.0. The vulnerability manifests during DOM tree serialization when custom policies are active, requiring attacker-controlled input data to be parsed and serialized by the library."
}