CVE-2026-5751 describes a parser-differential or mutation cross-site scripting (mXSS) vulnerability in EmilStenstrom justhtml versions 1.13.0 and earlier. The vulnerability arises when a custom SanitizationPolicy is used that preserves foreign namespaces (e.g., drop_foreign_namespaces=False with allowlisted SVG/MathML elements or raw-text containers like <style>). Specially crafted input can be sanitized into markup that appears safe but becomes unsafe upon re-parsing by browsers or other HTML parsers, allowing injection of malicious markup. The default safe configuration (sanitize=True) is not affected. The vulnerability is fixed in version 1.14.0.

An attacker can craft input that bypasses sanitization under certain custom configurations, leading to injection of malicious markup through mutation XSS. This can result in cross-site scripting attacks if the vulnerable sanitization policy is used. The default configuration is not vulnerable, limiting exposure to users who customize sanitization policies to preserve foreign namespaces.

Upgrade justhtml to version 1.14.0 or later, where this vulnerability is fixed. Avoid using custom SanitizationPolicy configurations that preserve foreign namespaces unless necessary and ensure they are carefully reviewed. The default safe configuration (sanitize=True) is not affected and can be used to mitigate risk.