CVE-2026-7808 Overview
CVE-2026-7808 affects the justhtml Python library before version 1.16.0. The library contains multiple HTML sanitization bypass issues that allow active or dangerous content such as <script> or <style> elements to survive sanitization. Attackers can leverage these bypasses to deliver cross-site scripting (XSS) payloads through content that applications assume is safe. The issues primarily affect advanced usage patterns rather than the default JustHTML(..., sanitize=True) path for ordinary parsed HTML. The maintainers fixed the bypasses in justhtml 1.16.0.
Critical Impact
Attackers can bypass HTML sanitization to inject executable script or style content, enabling stored or reflected XSS against applications that rely on justhtml for output sanitization.
Affected Products
- justhtml versions prior to 1.16.0
- Applications using mutated or reused sanitization policy objects, including exported defaults
- Custom policies that preserve SVG or MathML content
Discovery Timeline
- 2026-08-23 - CVE-2026-7808 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-7808
Vulnerability Analysis
The advisory identifies four related sanitization bypass classes tracked under [CWE-20] Improper Input Validation. Each class allows an attacker to smuggle active content past the sanitizer under specific conditions.
First, mutating or reusing sanitization policy objects — including exported defaults — can weaken later sanitization calls. Shared policy state means one caller's changes propagate to subsequent invocations. Second, programmatic Document Object Model (DOM) input passed to sanitize() or sanitize_dom() misses mixed-case tag names such as ScRiPt or StYlE. Third, crafted programmatic doctype names serialize into active markup, providing another injection vector. Fourth, custom policies that preserve Scalable Vector Graphics (SVG) or Mathematical Markup Language (MathML) content allow animation elements, presentation attributes containing external url(...) references, or DOM trees mislabeled as namespace="html" to bypass foreign-content checks.
Root Cause
The root cause is inconsistent enforcement of sanitization rules across the library's parsing paths. Tag name comparisons are case-sensitive where they must be case-insensitive. Policy objects are mutable and shared without isolation. Foreign-content namespace checks trust an attacker-controllable label rather than the actual element namespace.
Attack Vector
An attacker submits crafted HTML, DOM, or doctype input to an application that passes it through justhtml sanitization. Successful bypass results in script or style content reaching the rendered page. Because the sanitizer is called over the network in typical web application flows, exploitation requires no privileges and no user interaction beyond viewing the affected page.
See the GitHub Security Advisory GHSA-4p64-v8f5-r2gx for the full list of affected code paths.
Detection Methods for CVE-2026-7808
Indicators of Compromise
- Rendered pages containing <script>, <style>, or SVG animation elements originating from user-supplied content processed by justhtml
- Application logs showing calls to sanitize() or sanitize_dom() with programmatic DOM inputs containing mixed-case tag names such as ScRiPt or StYlE
- Outbound requests to unexpected domains from url(...) references in CSS presentation attributes on rendered content
Detection Strategies
- Inventory application dependencies to identify installations of justhtml at versions below 1.16.0
- Review code paths that mutate exported default policy objects or share policy instances across requests
- Inspect custom sanitization policies that enable SVG or MathML preservation and audit their allowed element and attribute lists
Monitoring Recommendations
- Instrument the web tier to alert on responses containing script tags in fields expected to hold sanitized user content
- Deploy Content Security Policy (CSP) reporting to surface inline script or external resource violations that indicate bypass attempts
- Correlate web application firewall (WAF) events with server-side sanitization logs to identify crafted doctype and mixed-case tag payloads
How to Mitigate CVE-2026-7808
Immediate Actions Required
- Upgrade justhtml to version 1.16.0 or later across all environments
- Audit application code for policy object mutation and reuse patterns, then refactor to construct fresh policies per sanitization context
- Restrict custom policies to disable SVG and MathML preservation unless strictly required by the application
Patch Information
The maintainers fixed all four bypass classes in justhtml 1.16.0. Refer to the GitHub Security Advisory GHSA-4p64-v8f5-r2gx and the VulnCheck Security Advisory on JustHTML for version and remediation details.
Workarounds
- Enforce a strict Content Security Policy that blocks inline scripts and unexpected external resources as a defense-in-depth control
- Validate and normalize tag names to lowercase before passing programmatic DOM input to sanitize_dom()
- Reject or strip user-supplied doctype declarations before sanitization
# Upgrade justhtml to the fixed release
pip install --upgrade "justhtml>=1.16.0"
# Verify installed version
python -c "import justhtml, sys; print(justhtml.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
