Is CVE-2026-5751 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5751 being exploited in the wild.

How severe is CVE-2026-5751?

Medium severity, with a CVSS score of 6.1, published 23 August 2026.

Which products and versions are affected?

justhtml (PyPI) ECOSYSTEM:introduced=1.13.0,fixed=1.14.0.

Is there a fix for CVE-2026-5751?

Yes. justhtml (PyPI): upgrade to 1.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5751 attacked?

It is attacked over the network.

Am I affected by CVE-2026-5751?

Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5751: justhtml mutation cross-site scripting in custom sanitization policies

CVE-2026-5751 · Severity: medium · CVSS 6.1 · Published 2026-08-23

justhtml is a Python library for sanitizing HTML content to prevent security attacks. Versions 1.13.0 and earlier contain a flaw in custom sanitization policies that can allow attackers to inject malicious markup when foreign namespaces (SVG, MathML) or raw-text containers are preserved. The injected code appears safe initially but becomes executable when re-parsed, potentially compromising users who view the content. The default secure configuration is unaffected.

Technologies: justhtml (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-5751 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5751 being exploited in the wild.
How severe is CVE-2026-5751?: Medium severity, with a CVSS score of 6.1, published 23 August 2026.
Which products and versions are affected?: justhtml (PyPI) ECOSYSTEM:introduced=1.13.0,fixed=1.14.0.
Is there a fix for CVE-2026-5751?: Yes. justhtml (PyPI): upgrade to 1.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5751 attacked?: It is attacked over the network.
Am I affected by CVE-2026-5751?: Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

justhtml (PyPI): upgrade to 1.14.0 or later
```
pip install "justhtml>=1.14.0"
```

Technical details

A mutation XSS (mXSS) vulnerability exists in justhtml's custom sanitization policies when drop_foreign_namespaces=False or when foreign elements/raw-text containers are allowlisted. The vulnerability is a parser-differential attack: specially crafted HTML input sanitizes to markup that appears benign under one parser but becomes malicious when re-parsed by a browser or alternative HTML parser. The attack requires custom policy configuration; the default sanitize=True mode is not vulnerable. Attack vector is network-based with user interaction (viewing content). Fixed in version 1.14.0.

Affected products

justhtml justhtml <=1.13.0

Identifiers

CVE-2026-5751
GHSA-r758-8hxw-4845

Timeline

2026-04-05: disclosed: GitHub Security Advisory GHSA-r758-8hxw-4845 published
2026-08-23: patched: Fixed in justhtml 1.14.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.