CVE-2026-5751

Medium

Description

justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vulnerability when using a custom SanitizationPolicy that preserves foreign namespaces (e.g., drop_foreign_namespaces=False with allowlisted SVG/MathML elements or raw-text containers such as <style>). Specially crafted input can sanitize into markup that appears safe but becomes unsafe when re-parsed by a browser or another HTML parser, allowing markup injection. The default safe configuration (sanitize=True) is not affected. Fixed in 1.14.0.

SeverityMedium

CVSS6.1

Exploit probability—

ProductJusthtml

PublishedAug 23, 2026

First seenAug 23, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

justhtml1.14.0 or later

Vendor advisories

github.com/EmilStenstrom/justhtml/security/advisories/GHSA-r758-8hxw-4845

Affected products

Product	Affected versions	Fixed in
justhtmlPyPI	1.13.0 ≤ v < 1.14.0	1.14.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.