CVE-2026-8630: justhtml Library mXSS Vulnerability

CVE-2026-8630 Overview

CVE-2026-8630 is a mutation cross-site scripting (mXSS) vulnerability in justhtml versions <= 1.11.0, fixed in 1.12.0. The flaw resides in the serialization of raw-text elements such as <style> and <script>. When sanitize_dom() runs with a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping. Attacker-controlled text containing the matching closing tag sequence can break out of the raw-text context and inject arbitrary HTML into the sanitized output. The default sanitization policy is not affected because it drops the contents of <style> and <script> [CWE-79].

Critical Impact
Applications using custom justhtml policies that preserve <style> or <script> elements can be tricked into emitting attacker-controlled HTML, enabling client-side script execution against downstream viewers.

Affected Products

justhtml Python library versions <= 1.11.0
Applications invoking sanitize_dom() with custom policies that retain <style> or <script> elements
Downstream services rendering output produced by vulnerable justhtml configurations

Discovery Timeline

2026-08-23 - CVE-2026-8630 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-8630

Vulnerability Analysis

The vulnerability is a mutation XSS in the HTML serialization stage of justhtml. The library parses input into a DOM tree, applies a policy through sanitize_dom(), then serializes the result back to HTML. For most element types, text nodes are HTML-escaped during serialization so characters like < become <. Raw-text elements defined by the HTML specification, notably <style> and <script>, do not permit entity decoding inside their content. justhtml handled this by emitting their text nodes verbatim, without escaping and without validating that the payload cannot contain the element's closing tag.

When a custom policy allows one of these elements, an attacker who controls the inner text can embed the literal sequence </style> or </script>. The browser terminates the raw-text context at that sequence and parses subsequent bytes as HTML markup. The result is that content the sanitizer treated as inert text is reinterpreted as active markup by the consuming client. This mutation between the sanitizer's DOM view and the browser's re-parse of the serialized output is the defining characteristic of mXSS.

Root Cause

The root cause is missing context-aware escaping during serialization of raw-text element content. Because raw-text elements cannot use HTML entities, the sanitizer must instead reject or neutralize any occurrence of the element's end-tag sequence in the text. justhtml did neither, trusting that policy-approved DOM nodes were safe to write out unchanged.

Attack Vector

Exploitation requires an application that (1) uses justhtml at version 1.11.0 or below, (2) configures a custom policy retaining <style> or <script>, and (3) accepts attacker-influenced text inside those elements. The attacker submits input that contains a matching closing tag followed by chosen markup, for example an injected <img> with an event handler. After sanitization and rendering, the injected markup executes in the viewer's browser session. Because delivery is over the network and requires a victim to load the sanitized page, user interaction is a factor in exploitation. See the GitHub Security Advisory and the VulnCheck Advisory on XSS for full technical details.

Detection Methods for CVE-2026-8630

Indicators of Compromise

Sanitized HTML output containing unexpected </style> or </script> sequences followed by additional markup.
Application logs showing sanitize_dom() calls with custom policies that allow style or script elements.
Server-rendered pages generating client-side errors or script executions attributable to user-supplied content fields.

Detection Strategies

Perform a dependency inventory to identify Python services using justhtml at version <= 1.11.0.
Audit calls to sanitize_dom() for custom policies that include style or script in their allow-lists.
Run regression fuzzing that submits payloads containing </style> and </script> sequences and inspect serialized output for markup escape.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting endpoints to capture inline script violations from sanitized pages.
Monitor web application firewall (WAF) telemetry for request bodies containing raw closing tags in fields bound to sanitized rendering.
Alert on browser-side JavaScript errors originating from user-generated content templates.

How to Mitigate CVE-2026-8630

Immediate Actions Required

Upgrade justhtml to version 1.12.0 or later across all environments.
Review every custom sanitize_dom() policy and remove style and script from allow-lists unless strictly required.
Re-sanitize or invalidate cached HTML fragments produced by vulnerable versions when custom policies were in use.

Patch Information

The maintainers fixed the issue in justhtml1.12.0. Upgrade using pip install --upgrade justhtml>=1.12.0 and rebuild any container images or lockfiles that pin the vulnerable release. Refer to the GitHub Security Advisory for the fix commit and release notes.

Workarounds

Use the default justhtml sanitization policy, which drops the contents of <style> and <script> and is not affected.
If custom styling must be supported, pre-strip any occurrence of </style> and </script> from user input before passing it to the sanitizer.
Deploy a strict Content Security Policy that blocks inline scripts and restricts style sources to reduce impact if injection occurs.

bash

# Configuration example
pip install --upgrade 'justhtml>=1.12.0'
pip show justhtml | grep -i version