CVE-2026-6827: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in EmilStenstrom justhtml

justhtml versions prior to 1.17.0 contain multiple security flaws related to sanitization, serialization, and DOM handling. When custom policies preserve foreign namespaces (SVG/MathML), dangerous HTML integration points and mutation-XSS payloads can survive sanitization and become active after reparsing. SVG filter attributes and preserved <style> elements can load external CSS resources. Programmatic creation of script, style, or Comment nodes may serialize into active markup. Additional fixes address sanitize-pipeline cache mutations and DOM parent/child cycles that could cause infinite loops. Most vulnerabilities impact advanced or custom configurations rather than the default safe mode.

An attacker could exploit these sanitization weaknesses to inject malicious HTML or scripts, leading to cross-site scripting attacks. This could result in execution of arbitrary scripts in the context of the affected web application, potentially compromising user data or session integrity. However, the issues primarily affect non-default, advanced configurations, reducing the risk for typical users relying on default safe sanitization.

Upgrade to justhtml version 1.17.0 or later, which includes fixes for these sanitization and serialization issues. Users employing default sanitization settings (JustHTML(..., sanitize=True)) are less likely to be affected. Review and avoid custom policies that preserve foreign namespaces unless necessary and ensure they are updated to the fixed version. Patch status is not explicitly confirmed in the input data; verify with the vendor advisory for the latest remediation guidance.