CVE Feed

    Dashboard / CVE / CVE-2026-74793

    CVE-2026-74793

    justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling stored or reflected XSS attacks.

    Published:Aug 23, 2026
    Last Modified:Aug 24, 2026
    EPS:Aug 23, 2026
    EPSS Score:0.00204
    CVSS Score:6.1

    Affected Products

    Vendor
    Emilstenstrom
    Product
    Justhtml

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-9769 (CVSS 8.7) — justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service.…
    CVE-2026-8630 (CVSS 5.1) — justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in t…
    CVE-2026-8445 (CVSS 9.3) — justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle br…
    CVE-2026-7808 (CVSS 9.3) — justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous conte…
    CVE-2026-77088 (CVSS 5.3) — justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inl…
    CVE-2026-6827 (CVSS 5.1) — justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM …
    CVE-2026-5751 (CVSS 5.1) — justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vuln…
    CVE-2026-5389 (CVSS 5.1) — justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function whe…
    CVE-2026-5388 (CVSS 9.3) — justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_ur…
    CVE-2026-4671 (CVSS 8.7) — justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and li…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High