CVE-2026-7808: Improper Input Validation in EmilStenstrom justhtml

justhtml before 1.16.0 has multiple HTML sanitization bypass issues that can allow dangerous active content (e.g., script or style elements) to survive sanitization, potentially enabling cross-site scripting attacks. The vulnerabilities arise primarily in advanced use cases such as mutating or reusing sanitization policy objects, handling programmatic DOM inputs with mixed-case tag names, crafted doctype names that serialize into active markup, and custom policies that preserve SVG or MathML content allowing animation elements or external URL references to bypass foreign-content checks. These issues do not generally affect the default sanitization path (JustHTML(..., sanitize=True)). The issues are resolved in version 1.16.0.

The vulnerability can lead to cross-site scripting (XSS) by allowing active and dangerous HTML content to bypass sanitization in affected versions. This can result in execution of malicious scripts or styles in the context of the affected application, potentially compromising user data or application integrity. The CVSS 4.0 score is 9.3 (critical), indicating high impact with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Upgrade justhtml to version 1.16.0 or later, where these sanitization bypass issues have been fixed. No other mitigation is indicated or required as the fix addresses the root cause.