AI description
CVE-2026-7808 identifies multiple HTML sanitization bypass vulnerabilities within the `justhtml` library, affecting versions prior to 1.16.0. These flaws enable active or dangerous content, such as script or style tags, to persist through sanitization processes. This can potentially lead to cross-site scripting (XSS) attacks. The vulnerabilities primarily impact advanced usage scenarios of the `justhtml` library. This includes situations like mutating or reusing sanitization policy objects, which can weaken subsequent sanitization, or programmatic DOM input to `sanitize()`/`sanitize_dom()` that might overlook mixed-case tag names. Additionally, crafted programmatic doctype names could serialize into active markup, and custom policies preserving SVG or MathML might allow animation elements or external URL references to bypass foreign-content checks.
- Description
- justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML(..., sanitize=True) path for ordinary parsed HTML: mutating or reusing sanitization policy objects (including exported defaults) could weaken later sanitization; programmatic DOM input to sanitize()/sanitize_dom() could miss mixed-case tag names (e.g., ScRiPt, StYlE); crafted programmatic doctype names could serialize into active markup; and custom policies preserving SVG or MathML could allow animation elements, presentation attributes with external url(...) references, or DOM trees mislabeled as namespace="html" to bypass foreign-content checks. Fixed in 1.16.0.
- Source
- disclosure@vulncheck.com
- NVD status
- Deferred
CVSS 4.0
- Type
- Secondary
- Base score
- 9.3
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- CRITICAL
CVSS 3.1
- Type
- Secondary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
- disclosure@vulncheck.com
- CWE-20
- Hype score
- Not currently trending
CVE-2026-7808 (CVSS 9.8): justhtml before 1.16.0 has HTML sanitization bypasses that can permit XSS. Update the library if present in your stack. https://t.co/7VB51sPWYQ via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/a6oNRpeojG
@ADKCyber
23 Aug 2026
39 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨*CVE* CVE-2026-7808 justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potent… https://t.co/SyjyR5jZvg ----- Traducción: CVE-2026-7808 jus… https://t.co/utmtNg
@infoflowcloud
23 Aug 2026
21 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2026-7808 justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potent… https://t.co/J6UgFVapBV
@CVEnew
23 Aug 2026
1668 Impressions
2 Retweets
2 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2026-7808 HTML Sanitization Bypass in justhtml Before 1.16.0 Leads to Cross-Site Scripting https://t.co/pXhFmrtvnH
@VulmonFeeds
23 Aug 2026
41 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes