CVE-2026-7808 justhtml before 1.16.0 Multiple Security Issues via Sanitization
Attackers can bypass HTML sanitization in justhtml to inject scripts, leading to cross-site scripting in applications using advanced or non-default sanitization configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-7808?
CVE-2026-7808 is a critical cross-site scripting vulnerability in EmilStenstrom justhtml, published on 23 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML(..., sanitize=True) path for ordinary parsed HTML: mutating or reusing sanitization policy objects (including exported defaults) could weaken later sanitization; programmatic DOM input to sanitize()/sanitize_dom() could miss mixed-case tag names (e.g., ScRiPt, StYlE); crafted programmatic doctype names could serialize into active markup; and custom policies preserving SVG or MathML could allow animation elements, presentation attributes with external url(...) references, or DOM trees mislabeled as namespace="html" to bypass foreign-content checks. Fixed in 1.16.0.
Weakness: CWE-20
Which versions are affected by CVE-2026-7808?
2 open source packages ship an affected version, including justhtml.
| Package | Affected | Fixed in |
|---|---|---|
justhtml PyPI | All versions | 1.16.0 |
justhtml PyPI | All versions | 1.16.0 |
How do I fix CVE-2026-7808?
Upgrade justhtml to 1.16.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-7808 being exploited?
There is no known exploitation of CVE-2026-7808 in the wild and no public exploit code.
Sources
Also known as GHSA-4p64-v8f5-r2gx, GHSA-fj35-9vw4-h76v.