CyberRota Analysis
AI-GeneratedVersions 1.13.0 and earlier of justhtml are vulnerable to a mutation cross-site scripting (mXSS) flaw due to improper handling of custom SanitizationPolicies that allow foreign namespaces. Attackers can exploit this vulnerability by injecting specially crafted input that appears safe but can lead to markup injection when re-parsed, potentially compromising user data or session integrity. Organizations using affected versions, particularly those with custom sanitization configurations, should prioritize upgrading to version 1.14.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vulnerability when using a custom SanitizationPolicy that preserves foreign namespaces (e.g., drop_foreign_namespaces=False with allowlisted SVG/MathML elements or raw-text containers such as <style>). Specially crafted input can sanitize into markup that appears safe but becomes unsafe when re-parsed by a browser or another HTML parser, allowing markup injection. The default safe configuration (sanitize=True) is not affected. Fixed in 1.14.0.