CVE Feed

    Dashboard / CVE / CVE-2026-5751

    CVE-2026-5751

    justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vulnerability when using a custom SanitizationPolicy that preserves foreign namespaces (e.g., drop_foreign_namespaces=False with allowlisted SVG/MathML elements or raw-text containers such as <style>). Specially crafted input can sanitize into markup that appears safe but becomes unsafe when re-parsed by a browser or another HTML parser, allowing markup injection. The default safe configuration (sanitize=True) is not affected. Fixed in 1.14.0.

    Published:Aug 23, 2026
    Last Modified:Aug 24, 2026
    EPS:Aug 23, 2026
    EPSS Score:0.00188
    CVSS Score:6.1

    Affected Products

    Vendor
    Emilstenstrom
    Product
    Justhtml

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-9769 (CVSS 8.7) — justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service.…
    CVE-2026-8630 (CVSS 5.1) — justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in t…
    CVE-2026-8445 (CVSS 9.3) — justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle br…
    CVE-2026-7808 (CVSS 9.3) — justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous conte…
    CVE-2026-77088 (CVSS 5.3) — justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inl…
    CVE-2026-74793 (CVSS 5.1) — justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses even…
    CVE-2026-6827 (CVSS 5.1) — justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM …
    CVE-2026-5389 (CVSS 5.1) — justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function whe…
    CVE-2026-5388 (CVSS 9.3) — justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_ur…
    CVE-2026-4671 (CVSS 8.7) — justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and li…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High