CVE-2026-5751: justhtml Parser-Differential Cross-Site Scripting Vulnerability

Executive Summary

A parser-differential cross-site scripting (mXSS) vulnerability exists in justhtml versions 1.13.0 and earlier. This flaw allows for markup injection when using a custom SanitizationPolicy that preserves foreign namespaces. The default safe configuration (sanitize=True) is not affected. The vulnerability has a CVSS score of 6.1.

Technical Analysis

The vulnerability class is a parser-differential cross-site scripting (mXSS). The attack vector involves an attacker providing specially crafted input that sanitizes into markup appearing safe but becomes unsafe when re-parsed by a browser or another HTML parser. The root cause is the improper handling of custom SanitizationPolicies that preserve foreign namespaces (e.g., drop_foreign_namespaces=False with allowlisted SVG/MathML elements or raw-text containers such as