CVE-2026-8630 in justhtml
Summary
by MITRE • 08/23/2026
justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in the serialization of raw-text elements such as <style> and <script>. When a DOM tree is processed by sanitize_dom() using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the raw-text context and inject arbitrary HTML into the serialized output. The default sanitization policy is not affected because it drops the contents of style and script.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/23/2026
The justhtml library prior to version 1.12.0, encompassing all versions up to and including 1.11.0, contains a critical mutation cross-site scripting vulnerability within its serialization logic for raw-text elements such as script and style tags. This flaw arises from the specific handling of text nodes contained within these special DOM contexts during the sanitization process. When an application utilizes justhtml with a custom sanitization policy that explicitly permits the retention of script or style elements, the library serializes the inner text content literally without applying necessary escaping mechanisms. This behavior deviates from standard HTML parsing expectations where raw-text element contents are treated as opaque data until parsed again by the browser engine.
The technical root cause lies in how the sanitize_dom function processes these nodes under permissive policies. If an attacker can control the input that populates a script or style tag, they can inject text containing sequences that mimic closing tags for other elements or specific syntax that alters DOM structure when re-parsed by the browser. Because justhtml outputs this content without escaping it as character data, the resulting HTML document becomes malformed in a way that allows the injected payload to break out of its intended context. This is not a standard reflected or stored XSS but specifically a mutation-based cross-site scripting attack where the DOM itself is mutated during parsing and serialization cycles to execute malicious code.
The operational impact of this vulnerability is significant for applications relying on custom sanitization policies that allow script or style injection, which are often used in rich text editors or dynamic content rendering engines. An attacker who can influence the input fed into these components could craft a payload that survives the initial sanitization step and executes arbitrary JavaScript upon subsequent browser parsing. This execution context typically carries the privileges of the victim user, potentially leading to session hijacking, credential theft, defacement, or further pivoting within the application environment. The severity is heightened because many developers assume that keeping script tags safe if they are properly escaped, but in this specific serialization flow, the lack of escaping creates a direct code execution vector.
It is important to note that applications using the default sanitization policy provided by justhtml remain unaffected by this vulnerability. The default configuration explicitly drops or strips the contents of style and script elements entirely rather than preserving them for output. Therefore, the risk profile is contingent upon the specific implementation choices made by developers who have opted for custom policies allowing these raw-text nodes to persist in the final HTML output. This distinction highlights that while the library itself has a flaw, its safe default configuration mitigates exposure for most standard use cases unless explicitly overridden.
To mitigate this vulnerability, organizations must upgrade justhtml to version 1.12.0 or later where the serialization logic has been corrected to properly escape text nodes within raw-text elements even when those elements are retained by custom policies. For applications unable to immediately update dependencies, developers should review their sanitization configurations and avoid retaining script or style content unless absolutely necessary. If retention is required for legitimate functionality such as inline styling or dynamic scripts, alternative approaches like using data attributes with JavaScript-based rendering engines that handle escaping correctly at the application layer may provide a safer interim solution. Continuous monitoring of dependency updates and adherence to secure coding standards regarding DOM manipulation are essential practices to prevent exploitation of similar mutation XSS flaws in web applications.