justhtml versions prior to 1.17.0 contain multiple security issues related to sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces such as SVG and MathML, dangerous HTML integration points (e.g., SVG <foreignObject>, MathML <annotation-xml encoding="text/html">) and mutation-XSS parser-differential payloads can bypass sanitization and become active HTML after reparsing. Additionally, SVG filter="url(...)" and preserved <style> elements may allow resource-loading CSS via @import or background-image:url(). Programmatic script, style, and Comment nodes may serialize into active markup. Other hardening fixes address sanitize-pipeline cache mutation and DOM parent/child cycles that could cause infinite loops. Most issues impact advanced or custom configurations rather than the default JustHTML(..., sanitize=True) safe path.

The vulnerability allows potentially malicious content to bypass sanitization and execute as active HTML, leading to cross-site scripting (XSS) attacks. This could enable attackers to execute scripts in the context of the affected application, potentially leading to data theft, session hijacking, or other client-side impacts. However, the issues mainly affect advanced or custom sanitization policies rather than default safe configurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid using advanced or custom sanitization policies that preserve foreign namespaces until a fix is available. Using the default JustHTML(..., sanitize=True) configuration is safer as most issues do not affect this path.