Vulnerability Description
justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in the serialization of raw-text elements such as <style> and <script>. When a DOM tree is processed by sanitize_dom() using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the raw-text context and inject arbitrary HTML into the serialized output. The default sanitization policy is not affected because it drops the contents of style and script.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-qvc2-mg72-jjh
- https://www.vulncheck.com/advisories/justhtml-before-mutation-xss-via-raw-text-e
FAQ
What is CVE-2026-8630?
CVE-2026-8630 is a vulnerability with a CVSS score of 6.1 (MEDIUM). justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in the serialization of raw-text elements such as <style> and <script>. When a DOM tree is pro...
How severe is CVE-2026-8630?
CVE-2026-8630 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-8630?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.