CVE-2026-74793 Overview
CVE-2026-74793 is a cross-site scripting (XSS) vulnerability in the justhtml HTML sanitization library at versions prior to 3.11.0. The default sanitizer fails to strip event handlers in selectedcontent projections. Attackers can inject SVG or MathML elements with event handler attributes that are cloned and reinserted into rendered output without sanitization. This behavior enables both stored and reflected XSS against applications that rely on justhtml to render untrusted markup. The flaw is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session by submitting crafted SVG or MathML markup, leading to session theft, credential harvesting, or unauthorized actions in the application context.
Affected Products
- justhtml versions prior to 3.11.0
- Applications embedding justhtml for user-supplied HTML sanitization
- Downstream projects consuming the vulnerable sanitizer defaults
Discovery Timeline
- 2026-08-23 - CVE-2026-74793 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-74793
Vulnerability Analysis
The vulnerability resides in the default sanitizer used by justhtml when handling selectedcontent projections. Sanitizers typically strip event handler attributes such as onload, onerror, and onclick before returning cleaned markup. In vulnerable justhtml releases, this stripping logic does not run against nodes that are cloned during selectedcontent projection. Foreign content namespaces, specifically SVG and MathML, allow event handler attributes on elements that HTML parsers process with different casing and namespace rules. When the sanitizer clones these nodes and reinserts them into output, the event handler attributes survive intact. The result is executable JavaScript embedded in output that the application treats as safe HTML.
Root Cause
The root cause is incomplete attribute filtering across code paths. The primary sanitization routine removes event handlers from directly parsed nodes but does not reapply the same filter after nodes are cloned into selectedcontent projections. Foreign namespaces (SVG, MathML) amplify the gap because their parsing rules preserve attributes that HTML parsing would otherwise normalize or drop.
Attack Vector
Exploitation requires an attacker to submit HTML input that reaches justhtml and is later rendered in a victim's browser. The attacker crafts an SVG or MathML fragment containing an event handler attribute. When the application stores or reflects the sanitized output, the browser fires the event handler and executes attacker-controlled JavaScript. User interaction, such as viewing a page or hovering an element, is required to trigger the payload.
No verified public exploit code is available at the time of publication. See the GitHub Security Advisory GHSA-gjf2-f4jc-69xf and the VulnCheck Advisory for additional technical detail.
Detection Methods for CVE-2026-74793
Indicators of Compromise
- Rendered pages containing <svg> or <math> elements with on* event handler attributes surviving sanitization.
- Application logs showing HTML payloads containing onerror, onload, or onclick inside SVG or MathML tags submitted by users.
- Unexpected outbound requests from user browsers to attacker-controlled domains sourced from rendered content pages.
Detection Strategies
- Inventory application dependencies and flag any use of justhtml at versions below 3.11.0.
- Add web application firewall (WAF) rules that inspect POST bodies and query parameters for SVG or MathML fragments carrying event handler attributes.
- Review stored user-generated content for persisted payloads that match SVG or MathML tags with on* attributes.
Monitoring Recommendations
- Log the raw and sanitized HTML pairs during a bounded validation window to detect surviving event handlers.
- Monitor Content Security Policy (CSP) violation reports for inline script execution originating from rendered user content.
- Track browser error telemetry for JavaScript executions on templates that render sanitized HTML.
How to Mitigate CVE-2026-74793
Immediate Actions Required
- Upgrade justhtml to version 3.11.0 or later in all production and staging environments.
- Audit stored user-generated content for persisted XSS payloads and re-sanitize with the patched version.
- Enforce a strict Content Security Policy that blocks inline event handlers and untrusted script sources.
Patch Information
The maintainers addressed the issue in justhtml 3.11.0 by extending event handler removal to selectedcontent projections, including nodes cloned from SVG and MathML namespaces. Refer to the GitHub Security Advisory GHSA-gjf2-f4jc-69xf for the fix commits and release notes.
Workarounds
- Configure the sanitizer to reject SVG and MathML elements entirely until the upgrade is deployed.
- Apply a strict allowlist for HTML tags and attributes rather than relying on default deny rules.
- Deploy CSP headers with script-src 'self' and require-trusted-types-for 'script' to reduce exploit impact.
# Configuration example
pip install --upgrade 'justhtml>=3.11.0'
pip show justhtml | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
