MEDIUM 5.1 NVD
CVE-2026-74793
justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections.
justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling stored or reflected XSS attacks.
References
- https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-gjf2-f4jc-69xf
- https://www.vulncheck.com/advisories/justhtml-before-xss-via-selectedcontent-projection
This medium severity vulnerability with a CVSS score of 5.1 was published on 2026-08-23 via NVD.
vulnfeed aggregates 10855 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.