Is CVE-2026-6827 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6827 being exploited in the wild.

How severe is CVE-2026-6827?

Medium severity, with a CVSS score of 6.1, published 23 August 2026.

Which products and versions are affected?

justhtml (PyPI) ECOSYSTEM:introduced=0,fixed=1.17.0.

Is there a fix for CVE-2026-6827?

Yes. justhtml (PyPI): upgrade to 1.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6827 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6827?

Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6827: justhtml multiple sanitization and DOM handling vulnerabilities

CVE-2026-6827 · Severity: medium · CVSS 6.1 · Published 2026-08-23

justhtml is a Python HTML sanitization library used to remove malicious content from user-supplied HTML. Multiple security flaws in versions before 1.17.0 allow dangerous content to bypass sanitization and become active HTML, particularly when using custom policies for SVG or MathML namespaces, preserved styles, or programmatic DOM construction. Attackers can execute JavaScript (XSS), trigger resource fetches, or cause denial of service through infinite loops in affected configurations.

Technologies: justhtml (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-6827 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6827 being exploited in the wild.
How severe is CVE-2026-6827?: Medium severity, with a CVSS score of 6.1, published 23 August 2026.
Which products and versions are affected?: justhtml (PyPI) ECOSYSTEM:introduced=0,fixed=1.17.0.
Is there a fix for CVE-2026-6827?: Yes. justhtml (PyPI): upgrade to 1.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6827 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6827?: Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

justhtml (PyPI): upgrade to 1.17.0 or later
```
pip install "justhtml>=1.17.0"
```

Technical details

The vulnerability encompasses multiple weaknesses: (1) improper namespace handling allows SVG <foreignObject> and MathML <annotation-xml encoding="text/html"> integration points to survive sanitization when custom policies preserve foreign namespaces; (2) mutation-XSS and parser-differential payloads bypass filtering through reparse operations; (3) SVG filter="url(...)" and preserved <style> elements can include resource-loading CSS like @import or background-image:url() that trigger external requests; (4) programmatic script, style, and Comment nodes serialize into active markup; (5) cache mutation and DOM parent/child cycles cause infinite loops. Most issues require custom namespace policies or programmatic DOM construction; the default JustHTML(..., sanitize=True) configuration is not affected by most vectors.

Affected products

Emil Stenstrom justhtml before 1.17.0

Identifiers

CVE-2026-6827
GHSA-vrx2-77f2-ww34

Timeline

2026-04-19: disclosed
2026-04-19: patched: justhtml 1.17.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.