CVE-2026-74793: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in EmilStenstrom justhtml

CVE-2026-74793 describes a cross-site scripting vulnerability in EmilStenstrom justhtml prior to version 3.11.0. The vulnerability arises because the default sanitizer bypasses removal of event handlers in selectedcontent projections. Attackers can exploit this by injecting SVG or MathML elements containing event handlers, which are cloned and reinserted into the output without proper sanitization. This flaw allows for stored or reflected XSS attacks, potentially leading to script execution in the context of the affected web application.

Successful exploitation of this vulnerability allows attackers to execute arbitrary scripts in the context of users viewing the affected web pages. This can lead to session hijacking, defacement, or other malicious actions typical of cross-site scripting attacks. The CVSS 4.0 base score is 5.1, indicating a medium severity impact with network attack vector, low attack complexity, no privileges required, and user interaction needed.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting usage of the affected sanitizer features or avoid processing untrusted input that could include SVG or MathML elements with event handlers.