Parser-Differential XSS Vulnerability in Justhtml by Emil Stenstrom

CVE-2026-5751

What is CVE-2026-5751?

Justhtml versions prior to 1.14.0 contain a parser-differential cross-site scripting (mXSS) vulnerability. This issue arises when utilizing a custom SanitizationPolicy that preserves foreign namespaces, particularly when set to drop_foreign_namespaces=False alongside allowlisted SVG/MathML elements or raw-text containers like . Attackers can exploit this vulnerability by crafting special input that is sanitized into markup that deceptively appears safe, but becomes vulnerable during re-parsing by web browsers or other HTML parsers, enabling markup injection. The default configuration (sanitize=True) remains unaffected by this issue. Users are advised to upgrade to version 1.14.0 or later for a resolution.

References