CVE-2026-5751 Overview
CVE-2026-5751 is a mutation cross-site scripting (mXSS) vulnerability in the justhtml HTML sanitization library affecting versions 1.13.0 and earlier. The flaw arises when applications use a custom SanitizationPolicy that preserves foreign namespaces, such as drop_foreign_namespaces=False with allowlisted SVG or MathML elements, or raw-text containers like <style>. Specially crafted input passes sanitization but re-parses into unsafe markup in a browser or another HTML parser, enabling markup injection. The default safe configuration with sanitize=True is not affected. The maintainer fixed the issue in version 1.14.0.
Critical Impact
Attackers can inject executable HTML or script content that bypasses server-side sanitization, leading to reflected or stored XSS in downstream browser contexts [CWE-79].
Affected Products
- justhtml versions 1.13.0 and earlier
- Applications configured with custom SanitizationPolicy allowing foreign namespaces (SVG, MathML)
- Applications allowlisting raw-text containers such as <style>
Discovery Timeline
- 2026-08-23 - CVE-2026-5751 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-5751
Vulnerability Analysis
The vulnerability is a parser-differential mutation XSS. The justhtml sanitizer parses input under one set of HTML parsing rules and outputs markup that appears safe under those rules. When a browser re-parses the same markup, HTML5 tree-construction rules differ inside foreign content such as SVG and MathML, and inside raw-text elements like <style>. That divergence allows crafted input to mutate into executable script or event-handler markup after sanitization.
This pattern is well documented in HTML sanitizers that permit foreign-namespace content without normalizing token boundaries between namespaces. Content encoded as attribute text or CDATA inside <style> can be reinterpreted as tags or scripts when the browser transitions parsing modes.
Root Cause
The root cause is asymmetric parsing between the sanitizer and downstream HTML parsers. When a custom SanitizationPolicy sets drop_foreign_namespaces=False and permits SVG, MathML, or <style> content, justhtml fails to enforce namespace-aware serialization rules that guarantee stable re-parsing. The default policy avoids the issue by dropping foreign namespaces entirely.
Attack Vector
An attacker submits crafted HTML into any application input that flows through a vulnerable custom SanitizationPolicy. Exploitation requires user interaction (UI:A in the CVSS vector), typically viewing a page that renders the sanitized output. Successful exploitation results in script execution in the victim's browser session, cookie or token theft, and defacement of rendered content. The vulnerability does not affect confidentiality or integrity of the server-side application directly but compromises the security of downstream browser contexts.
See the GitHub Security Advisory GHSA-r758-8hxw-4845 and the VulnCheck Advisory on JustHTML XSS for reference material.
Detection Methods for CVE-2026-5751
Indicators of Compromise
- HTML content containing SVG or MathML elements with unexpected attribute payloads such as onload, onerror, or xlink:href referencing javascript: URIs after sanitization
- Sanitizer output containing <style> blocks with sequences that resolve to tag boundaries when re-parsed
- Web application logs showing anomalous input containing mixed namespace prefixes such as svg:, math:, or embedded <foreignObject> elements
Detection Strategies
- Audit application code for calls to justhtml that instantiate a custom SanitizationPolicy with drop_foreign_namespaces=False or that allowlist <style>, <svg>, or <math> elements
- Compare sanitizer input and output for parser-differential patterns by re-parsing sanitized output with a browser-grade HTML5 parser and diffing the token stream
- Deploy Content Security Policy (CSP) reporting to capture inline script violations that indicate successful mXSS execution
Monitoring Recommendations
- Ingest web application and WAF logs into a SIEM to alert on payloads containing foreign-namespace elements combined with event-handler attributes
- Monitor client-side error telemetry for CSP script-src violations tied to rendered user content
- Track dependency inventories for justhtml versions below 1.14.0 across production and CI environments
How to Mitigate CVE-2026-5751
Immediate Actions Required
- Upgrade justhtml to version 1.14.0 or later in all environments
- Inventory all uses of SanitizationPolicy and remove drop_foreign_namespaces=False unless strictly required
- Revoke or rotate any session tokens issued to users who may have rendered attacker-controlled sanitized content
Patch Information
The maintainer released justhtml version 1.14.0 containing the fix. Upgrade using the standard package manager, for example pip install --upgrade justhtml>=1.14.0. Details are documented in the GitHub Security Advisory GHSA-r758-8hxw-4845.
Workarounds
- Revert to the default configuration with sanitize=True, which is not affected by this vulnerability
- Remove foreign-namespace elements (SVG, MathML) and raw-text containers (<style>) from custom allowlists
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script-src to trusted origins
# Configuration example
pip install --upgrade 'justhtml>=1.14.0'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
