justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that allow active and dangerous content (such as script or style tags) to survive sanitization, potentially leading to cross-site scripting. The vulnerabilities affect advanced usage scenarios including: mutating or reusing sanitization policy objects (including exported defaults) which weakens later sanitization; programmatic DOM input to sanitize()/sanitize_dom() missing mixed-case tag names (e.g., ScRiPt, StYlE); crafted programmatic doctype names that serialize into active markup; and custom policies preserving SVG or MathML that allow animation elements, presentation attributes with external url(...) references, or DOM trees mislabeled as namespace="html" to bypass foreign-content checks.
An unauthenticated attacker can inject malicious HTML and JavaScript code that bypasses sanitization filters, allowing them to execute arbitrary JavaScript in the context of the application to steal user sessions, forge requests, or deface content.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Yes. A patch is available in version 1.16.0 or later.
Upgrade justhtml to version 1.16.0 or later. Additionally, review any custom sanitization policies in use—particularly those that preserve SVG or MathML content or those that reuse/mutate policy objects—and ensure they are not introducing additional bypass opportunities. Implement defense-in-depth measures such as Content Security Policy (CSP) headers to limit the impact of any XSS that may bypass sanitization.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD published the first details for CVE-2026-7808
A CVSS base score of 9.8 has been assigned.
Feedly found the first article mentioning CVE-2026-7808 . See article
A critical vulnerability with a CVSS score of 9.8 exists in the justhtml library, allowing HTML sanitization bypass that can lead to Cross-Site Scripting (XSS) attacks. Exploitation requires network access to an application using the vulnerable library, and while no public proof-of-concept exploits are available, users are advised to update to version 1.16.0 or newer to mitigate the risk. The vulnerability primarily affects advanced usage scenarios and could have downstream impacts on applications relying on justhtml for sanitization. See article
GitHub Advisories released a security advisory .
justhtml Critical Sanitization Bypass (CVE-2026-5388)
justhtml Sanitizer Bypass to XSS (CVE-2026-8445)
Critical XSS in justhtml Library (CVE-2026-7808)
Critical XSS flaw in justhtml library allows script injection
CVE-2026-7808 - Exploits & Severity - Feedly
justhtml Critical Sanitization Bypass (CVE-2026-5388)
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
