CVE-2026-6827

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.17.0

Description Security issues exist in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces like SVG or MathML, dangerous content such as HTML integration points (SVG <foreignObject>, MathML <annotation-xml encoding="text/html">) and mutation-XSS parser-differential payloads may survive sanitization and become active HTML after reparsing. Additionally, SVG filter="url(...)" and preserved <style> tags may allow resource-loading CSS via @import or background-image:url(). Programmatic script, style, or Comment nodes could serialize into active markup. Other issues include sanitize-pipeline cache mutation and DOM parent/child cycles that may lead to infinite loops. These issues primarily affect advanced or custom configurations rather than the default JustHTML(..., sanitize=True) path.

Recommendations Update to version 1.17.0 or later.