SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-6827

MEDIUM · CVSS 6.1 EPSS 0.19% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-23 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

JustHTML versions prior to 1.17.0 are vulnerable due to multiple security flaws in sanitization and DOM handling, which can allow dangerous content to bypass protections and execute as active HTML. This could lead to cross-site scripting (XSS) attacks, particularly when custom policies are implemented that preserve foreign namespaces like SVG and MathML. Organizations using JustHTML with advanced or custom configurations should prioritize updating to mitigate these risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-6827
Severity
MEDIUM
CVSS
6.1
EPSS
0.19%

Original NVD Description

justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces (SVG/MathML), dangerous content such as HTML integration points (SVG <foreignObject>, MathML <annotation-xml encoding="text/html">) and mutation-XSS parser-differential payloads could survive sanitization and become active HTML after reparse; SVG filter="url(...)" and preserved <style> could leave resource-loading CSS (@import, background-image:url()). Programmatic script/style/Comment nodes could serialize into active markup. Additional hardening fixes address sanitize-pipeline cache mutation and DOM parent/child cycles that could cause infinite loops. Most issues affect advanced or custom configurations rather than the default JustHTML(..., sanitize=True) safe path.