CVE-2026-8630: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in EmilStenstrom justhtml

CVE-2026-8630 is a mutation cross-site scripting vulnerability in justhtml prior to version 1.12.0 (<=1.11.0). The flaw arises during serialization of raw-text elements such as <style> and <script> when sanitize_dom() is used with a custom policy that preserves these elements. Text nodes inside these elements are serialized literally without escaping, enabling an attacker to inject arbitrary HTML by including matching closing tag sequences in the input. The default sanitization policy is not vulnerable because it drops the contents of style and script elements, preventing this injection.

An attacker can exploit this vulnerability to inject arbitrary HTML into the serialized output when a custom sanitization policy that retains <style> or <script> elements is used. This could lead to cross-site scripting attacks if the serialized output is rendered in a browser context. The default sanitization policy is not affected, so only users employing custom policies that keep these raw-text elements are at risk.

Upgrade justhtml to version 1.12.0 or later where this vulnerability is fixed. If upgrading is not immediately possible, avoid using custom sanitization policies that retain <style> or <script> elements, or ensure that text nodes inside these elements are properly escaped during serialization. Patch status is not explicitly confirmed in the input data, but the presence of a fixed version 1.12.0 indicates an official fix is available.