Cloudanix VulnDB

GHSA-r758-8hxw-4845

Low · 3.1

justhtml: Mutation XSS with custom foreign-namespace sanitization policies

CVSS

3.1

EPSS

—

Published

Apr 8, 2026

CISA due date

—

The record

A parser-differential / mutation XSS issue was found in `justhtml` when using a **custom sanitization policy** that preserves foreign namespaces such as SVG or MathML. Under these custom settings, specially crafted input could sanitize into HTML that looked safe at first, but became unsafe when parsed again by a browser or another HTML parser.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities