Cross-Site Scripting Vulnerability in JustHTML by Emil Stenstrom
CVE-2026-74793

5.1MEDIUM

Key Information:

Vendor

Emilstenstrom

Status
Justhtml
Vendor
CVE Published:
23 August 2026

What is CVE-2026-74793?

A vulnerability in JustHTML versions prior to 3.11.0 enables attackers to exploit a weakness in the default sanitizer, allowing them to bypass event handler removal in selectedcontent projections. This flaw can lead to the injection of malicious SVG or MathML elements containing event handlers. These elements may be cloned and reinserted into the output without undergoing proper sanitization, which facilitates both stored and reflected XSS attacks, jeopardizing user data and the integrity of web applications.

Affected Version(s)

justhtml 0 < 3.11.0

justhtml 3.11.0

References

https://github.com/EmilStenstrom/justhtml/security/adviso...
vendor-advisory
https://www.vulncheck.com/advisories/justhtml-before-xss-...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.