justhtml HTML Sanitization Bypass (Multiple XSS Vectors)

Technical Analysis

CVE-2026-7808 describes several distinct sanitization bypass conditions in justhtml: (1) reuse or mutation of sanitization policy objects, including exported default policies, can silently weaken protections applied to subsequent sanitization calls; (2) sanitize()/sanitize_dom() functions fail to normalize mixed-case tag names (e.g., ScRiPt, StYlE) when given programmatic DOM input, allowing them to bypass tag-based filtering; (3) crafted programmatic doctype names can be serialized back into active markup; and (4) custom policies that preserve SVG or MathML content can be abused via animation elements, presentation attributes containing external url(...) references, or DOM trees mislabeled with namespace="html" to evade foreign-content namespace checks. Exploitation requires an attacker-controlled input path into an application using justhtml for sanitization, most likely via user-submitted HTML, untrusted document ingestion, or automated content-processing pipelines. AI agent systems that use justhtml to sanitize HTML retrieved from the web, scraped documents, or user-provided content before feeding it into RAG pipelines, browser-automation tools, or downstream rendering are at risk of prompt injection or stored XSS payloads surviving sanitization and being executed in agent-controlled browser contexts or displayed to end users.

Affected Systems

justhtml Python package versions prior to 1.16.0; applications and services using JustHTML(..., sanitize=True) with custom/mutated policy objects, programmatic DOM input to sanitize()/sanitize_dom(), or custom policies preserving SVG/MathML content

Indicators of Compromise

• N/A - dependency vulnerability, no known active exploitation indicators; monitor for anomalous <script>/<style> tags with mixed-case obfuscation, crafted doctype declarations, and SVG/MathML payloads containing external url() references in ingested HTML content

Remediation Steps

1. 1

   Upgrade justhtml

   Update justhtml to version 1.16.0 or later across all services, agent pipelines, and dependency lockfiles.

2. 2

   Audit custom sanitization policies

   Review any code that reuses, mutates, or extends default sanitization policy objects, and avoid mutating shared/exported defaults.

3. 3

   Validate programmatic DOM inputs

   Ensure any DOM trees passed directly to sanitize()/sanitize_dom() are normalized for tag case and namespace labeling before sanitization.

4. 4

   Restrict SVG/MathML support

   Disable or tightly scope custom policies that preserve SVG/MathML unless strictly necessary, and audit for external url() references in presentation attributes.

5. 5

   Harden agent content pipelines

   For AI agent systems ingesting scraped or user-supplied HTML, add defense-in-depth output encoding and CSP controls in addition to library-level sanitization, and re-sanitize content before rendering in browser-automation or RAG display contexts.