Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-6827— justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnerabilities

Quick assessment

Affected

EmilStenstrom justhtml

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

EmilStenstrom JustHTML是EmilStenstrom个人开发者开源的一个纯 Python HTML5 解析器。 EmilStenstrom JustHTML 1.17.0之前版本存在跨站脚本漏洞，该漏洞源于清理、序列化和程序化DOM处理存在多个安全问题，可能导致跨站脚本攻击和无限循环。

CVSS 6.1 · Medium EPSS 0.26% · P17 Updated Aug 29, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise

Affected Version Matrix 2

Vendor	Product	Version Range	Status
EmilStenstrom	justhtml	`< 1.17.0`	affected
		`1.17.0`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-6827

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnerabilities

Source: CVE Program / CVE List V5

Vulnerability Description

justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces (SVG/MathML), dangerous content such as HTML integration points (SVG <foreignObject>, MathML <annotation-xml encoding="text/html">) and mutation-XSS parser-differential payloads could survive sanitization and become active HTML after reparse; SVG filter="url(...)" and preserved <style> could leave resource-loading CSS (@import, background-image:url()). Programmatic script/style/Comment nodes could serialize into active markup. Additional hardening fixes address sanitize-pipeline cache mutation and DOM parent/child cycles that could cause infinite loops. Most issues affect advanced or custom configurations rather than the default JustHTML(..., sanitize=True) safe path.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Vulnerability Title

EmilStenstrom JustHTML 跨站脚本漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
EmilStenstrom	justhtml	0 ~ 1.17.0	-

II. Public POCs for CVE-2026-6827

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-6827

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-6827 (2)

🔗 Multiple security fixes in justhtml 1.16.0 found by LLM · Advisory · EmilStenstrom/justhtml · GitHub vendor-advisory
🔗 justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnerabilities | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-6827

Same Patch Batch · EmilStenstrom · 2026-08-23 · 11 CVEs total

CVE-2026-7808	9.8 CRITICAL	justhtml before 1.16.0 Multiple Security Issues via Sanitization
CVE-2026-8445	9.8 CRITICAL	justhtml before 1.12.0 Sanitizer Bypass via Markdown
CVE-2026-5388	9.8 CRITICAL	justhtml before 1.15.0 Multiple Security Issues
CVE-2026-9769	7.5 HIGH	justhtml before 1.10.0 Denial of Service via deeply nested HTML
CVE-2026-4671	7.5 HIGH	justhtml before 1.18.0 Denial of Service via CSS Selector
CVE-2026-77088	6.1 MEDIUM	justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-span
CVE-2026-74793	6.1 MEDIUM	justhtml before 3.11.0 XSS via selectedcontent projection
CVE-2026-8630	6.1 MEDIUM	justhtml before 1.12.0 Mutation XSS via Raw Text Elements
CVE-2026-5751	6.1 MEDIUM	justhtml before 1.14.0 Mutation XSS via custom sanitization policies
CVE-2026-5389	6.1 MEDIUM	justhtml before 1.13.0 XSS via code fence breakout

IV. Related Vulnerabilities

Same product: justhtml

Same vendor: EmilStenstrom

Same weakness: CWE-79