The vulnerability in justhtml prior to 1.16.0 involves improper input validation and sanitization bypasses that allow active or dangerous HTML content (e.g., script or style elements) to persist after sanitization. This occurs primarily when sanitization policies are mutated or reused, when programmatic DOM inputs contain mixed-case tag names, when crafted doctype names serialize into active markup, or when custom policies preserve SVG or MathML elements that include animation or external URL references. These flaws can lead to cross-site scripting attacks. The issues do not affect the default sanitization path (JustHTML(..., sanitize=True)) for ordinary parsed HTML. The vulnerabilities were addressed and fixed in version 1.16.0.

Successful exploitation can result in cross-site scripting (XSS), allowing attackers to inject and execute malicious scripts in the context of affected applications using justhtml versions before 1.16.0. This can lead to compromise of user data, session hijacking, or other client-side attacks. The vulnerability is rated critical with a CVSS 4.0 score of 9.3, indicating high impact and ease of exploitation without privileges or user interaction.

Upgrade to justhtml version 1.16.0 or later, where these sanitization bypass issues have been fixed. Users relying on advanced sanitization policies or programmatic DOM inputs should ensure they apply the update to prevent potential cross-site scripting risks. No other official remediation or temporary fixes are indicated. Patch status is confirmed fixed in 1.16.0.