CVE-2026-8630 is a mutation cross-site scripting vulnerability in EmilStenstrom justhtml before version 1.12.0. The flaw arises during the serialization of raw-text elements such as <style> and <script> when processed by sanitize_dom() with a custom policy that keeps these elements. Text nodes inside these elements are serialized literally without escaping, enabling an attacker to inject arbitrary HTML by including matching closing tag sequences in the input. The default sanitization policy is unaffected because it drops the contents of style and script elements.

An attacker can exploit this vulnerability to inject arbitrary HTML into the serialized output when a custom sanitization policy that preserves <style> or <script> elements is used. This can lead to cross-site scripting attacks, potentially allowing execution of malicious scripts in the context of the affected application. The default policy is not vulnerable, limiting exposure to configurations using custom policies.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using custom sanitization policies that retain <style> or <script> elements in justhtml. Prefer the default sanitization policy which drops the contents of these elements to prevent exploitation.