CVE-2026-6827 Overview
CVE-2026-6827 affects the justhtml Python HTML sanitization library in versions prior to 1.17.0. The library contains multiple cross-site scripting (XSS) issues [CWE-79] spanning sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces such as SVG or MathML, dangerous content can survive sanitization and become active HTML after reparse. Additional issues include resource-loading CSS via preserved <style> and filter="url(...)", programmatic script and comment nodes serializing into active markup, sanitize-pipeline cache mutation, and DOM parent/child cycles that can trigger infinite loops. The default JustHTML(..., sanitize=True) safe path is largely unaffected.
Critical Impact
Applications using custom justhtml policies that preserve SVG or MathML namespaces can allow mutation-XSS payloads to execute in victim browsers after reparse.
Affected Products
- justhtml versions prior to 1.17.0
- Applications using custom sanitization policies preserving SVG/MathML namespaces
- Applications relying on programmatic script, style, or Comment node handling in justhtml
Discovery Timeline
- 2026-08-23 - CVE-2026-6827 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-6827
Vulnerability Analysis
The vulnerability class is cross-site scripting [CWE-79], with the attack vector being network-based content that requires user interaction to render. The flaws cluster around parser-differential behavior: content that appears benign in the sanitizer's DOM view becomes executable after serialization and browser reparse.
Four distinct issue categories exist in justhtml before 1.17.0. First, HTML integration points inside preserved foreign namespaces, including SVG <foreignObject> and MathML <annotation-xml encoding="text/html">, allow HTML content to be smuggled through SVG or MathML sanitization contexts. Second, SVG filter="url(...)" attributes and preserved <style> elements can retain resource-loading CSS constructs such as @import and background-image:url(). Third, programmatic script, style, and Comment nodes serialize into active markup rather than inert text. Fourth, sanitize-pipeline cache mutation and DOM parent/child cycles create infinite loops that can degrade availability.
Root Cause
The root cause is inconsistent handling between the sanitizer's parsed DOM representation and the browser's reparse of the serialized output. When custom policies preserve foreign namespaces, the sanitizer treats integration points as inert, but browsers reparse embedded HTML as active content. Missing normalization of programmatic nodes and unbounded traversal of DOM cycles compound the issue.
Attack Vector
An attacker submits crafted HTML containing SVG or MathML integration points, CSS resource-loading directives, or programmatic node structures to an application that uses a non-default justhtml configuration. When the sanitized output is rendered in a victim's browser, mutation-XSS payloads activate. Exploitation requires user interaction to visit the rendered page.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-vrx2-77f2-ww34 and the VulnCheck Advisory on XSS Vulnerabilities for technical details.
Detection Methods for CVE-2026-6827
Indicators of Compromise
- Rendered HTML output containing <foreignObject> or <annotation-xml encoding="text/html"> elements from user-submitted content.
- Persisted content with SVG filter="url(...)" attributes or <style> blocks referencing @import or background-image:url().
- Application logs showing infinite loops, worker timeouts, or high CPU usage in sanitization pipelines.
Detection Strategies
- Inventory Python dependencies and identify any justhtml installations below 1.17.0 using pip list or SBOM tooling.
- Audit application source for custom JustHTML policies that enable SVG or MathML namespace preservation, and for direct programmatic construction of script, style, or Comment nodes.
- Deploy Content Security Policy (CSP) violation reporting to identify unexpected inline script execution or external resource loads originating from user content.
Monitoring Recommendations
- Monitor web application response bodies for foreign namespace elements emitted through content pipelines that were expected to strip them.
- Alert on abnormal sanitizer worker CPU or wall-clock time indicative of DOM cycle infinite loops.
- Correlate CSP report-uri telemetry with user-generated content submissions to identify sanitization bypass attempts.
How to Mitigate CVE-2026-6827
Immediate Actions Required
- Upgrade justhtml to version 1.17.0 or later across all applications and CI/CD build pipelines.
- Review custom JustHTML policy configurations and disable SVG or MathML namespace preservation unless strictly required.
- Remove or refactor code that constructs script, style, or Comment nodes programmatically before sanitization output.
Patch Information
The maintainers released justhtml version 1.17.0 addressing all reported issues. Refer to the GitHub Security Advisory GHSA-vrx2-77f2-ww34 for the full fix list and upgrade guidance.
Workarounds
- Use the default JustHTML(..., sanitize=True) safe path, which is not affected by most of the reported issues.
- Enforce a strict Content Security Policy that blocks inline scripts and restricts external resource loads to trusted origins.
- Strip SVG and MathML elements at an ingress filter before content reaches justhtml sanitization when foreign namespaces are not needed.
# Upgrade justhtml to the patched release
pip install --upgrade 'justhtml>=1.17.0'
# Verify installed version
pip show justhtml | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
