CVE-2026-8630

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.12.0

Description A mutation cross-site scripting (mXSS) issue exists during the serialization of raw-text elements, such as <style> and <script>. When the sanitize dom() function processes a DOM tree using a custom policy that retains these elements, text nodes within them are serialized literally without escaping. This allows an attacker to provide text containing a matching closing tag sequence to exit the raw-text context and inject arbitrary HTML into the serialized output. The default sanitization policy is not affected as it removes the contents of these elements.

Recommendations Update to version 1.12.0 or later. As a temporary mitigation, avoid using custom policies in the sanitize dom() function that allow the retention of <style> and <script> elements.