CVE-2026-8630 justhtml before 1.12.0 Mutation XSS via Raw Text Elements
Attackers can inject arbitrary HTML via mutation XSS in justhtml when custom policies retain raw-text elements like style or script.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-8630?
CVE-2026-8630 is a medium-severity cross-site scripting vulnerability in EmilStenstrom justhtml, published on 23 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in the serialization of raw-text elements such as <style> and <script>. When a DOM tree is processed by sanitize_dom() using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the raw-text context and inject arbitrary HTML into the serialized output. The default sanitization policy is not affected because it drops the contents of style and script.
Weakness: CWE-79
Which versions are affected by CVE-2026-8630?
2 open source packages ship an affected version, including justhtml.
| Package | Affected | Fixed in |
|---|---|---|
justhtml PyPI | All versions | 1.12.0 |
justhtml PyPI | All versions | 1.12.0 |
How do I fix CVE-2026-8630?
Upgrade justhtml to 1.12.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-8630 being exploited?
There is no known exploitation of CVE-2026-8630 in the wild and no public exploit code.
Sources
Also known as GHSA-qvc2-mg72-jjhx, GHSA-rc3v-3cc7-h7h5.