HTML Sanitization Bypass Vulnerabilities in JustHTML by Emil Stenstrom

CVE-2026-7808

What is CVE-2026-7808?

JustHTML versions prior to 1.16.0 exhibit vulnerabilities that allow for HTML sanitization bypass, which could permit active and potentially harmful content—like scripts or styles—to evade sanitization. This issue may manifest in advanced usage scenarios, notably when modifying or re-using sanitization policies. It includes risks such as the failure to adequately sanitize mixed-case HTML tags, serialization of crafted programmatic doctype names that might result in active markup, and weaknesses in custom sanitization policies that could let malicious SVG or MathML content through. The vulnerabilities have been addressed in version 1.16.0.

References