Mutation Cross-Site Scripting Vulnerability in JustHTML by Emil Stenstrom

CVE-2026-8630

What is CVE-2026-8630?

JustHTML versions prior to 1.12.0 contain a mutation cross-site scripting (mXSS) vulnerability due to improper serialization of raw-text elements such as and . The issue arises when a DOM tree is processed using the sanitize_dom() function with a custom policy that retains these elements. As a result, text nodes within them can be serialized literally without appropriate escaping. This flaw allows an attacker to inject arbitrary HTML into the output by manipulating text containing the appropriately matched closing tag sequence. It is important to note that the default sanitization policy is not affected, as it removes the contents of the style and script elements.

References