Multiple Security Issues in JustHTML by Emil Stenstrom

CVE-2026-6827

What is CVE-2026-6827?

JustHTML before version 1.17.0 contains multiple security flaws related to improper sanitization and serialization, as well as issues with programmatic DOM handling. When custom policies allow foreign namespaces like SVG and MathML, harmful content may bypass sanitization, potentially resulting in active HTML being rendered. This includes risks from SVG integration points and mutation-XSS payloads, which could exploit the sanitization pipeline. Moreover, vulnerabilities in CSS handling can lead to resource loading issues. While these problems primarily impact advanced or custom configurations, they elevate security risks beyond the typical safe path provided by JustHTML.

References