CVE-2026-5751: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in EmilStenstrom justhtml

CVE-2026-5751 is a mutation cross-site scripting (mXSS) vulnerability in justhtml up to version 1.13.0. It occurs when a custom SanitizationPolicy is used that preserves foreign namespaces (e.g., drop_foreign_namespaces=False with allowlisted SVG/MathML elements or raw-text containers like <style>). The vulnerability arises because input sanitized under these conditions can be transformed into markup that appears safe but becomes unsafe upon re-parsing by browsers or other HTML parsers, allowing markup injection. The default configuration with sanitize=True is not vulnerable. The vulnerability is fixed in version 1.14.0.

An attacker can inject unsafe markup through specially crafted input when a vulnerable version of justhtml is used with a custom SanitizationPolicy preserving foreign namespaces. This can lead to cross-site scripting attacks, potentially allowing execution of malicious scripts in the context of affected web pages. The default safe configuration is not affected, limiting exposure to configurations that explicitly enable the vulnerable sanitization policy.

Upgrade justhtml to version 1.14.0 or later, where this vulnerability is fixed. Avoid using custom SanitizationPolicy configurations that preserve foreign namespaces unless necessary and ensure they are updated to the fixed version. The default configuration (sanitize=True) is not affected and does not require changes.