# CVE-2026-6827: justhtml multiple sanitization and DOM handling vulnerabilities

Source: https://junglewise.ai/threats/cve-2026-6827-justhtml-multiple-sanitization-and-dom-handling-vulnerabilities  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-6827 · Severity: medium · CVSS 6.1 · Published 2026-08-23

justhtml is a Python HTML sanitization library used to remove malicious content from user-supplied HTML. Multiple security flaws in versions before 1.17.0 allow dangerous content to bypass sanitization and become active HTML, particularly when using custom policies for SVG or MathML namespaces, preserved styles, or programmatic DOM construction. Attackers can execute JavaScript (XSS), trigger resource fetches, or cause denial of service through infinite loops in affected configurations.

Technologies: [justhtml (PyPI)](https://junglewise.ai/threats/technologies/justhtml). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-6827 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6827 being exploited in the wild.

**How severe is CVE-2026-6827?** Medium severity, with a CVSS score of 6.1, published 23 August 2026.

**Which products and versions are affected?** justhtml (PyPI) ECOSYSTEM:introduced=0,fixed=1.17.0.

**Is there a fix for CVE-2026-6827?** Yes. justhtml (PyPI): upgrade to 1.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6827 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6827?** Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- justhtml (PyPI): upgrade to 1.17.0 or later

  ```sh
  pip install "justhtml>=1.17.0"
  ```


## Technical details

The vulnerability encompasses multiple weaknesses: (1) improper namespace handling allows SVG <foreignObject> and MathML <annotation-xml encoding="text/html"> integration points to survive sanitization when custom policies preserve foreign namespaces; (2) mutation-XSS and parser-differential payloads bypass filtering through reparse operations; (3) SVG filter="url(...)" and preserved <style> elements can include resource-loading CSS like @import or background-image:url() that trigger external requests; (4) programmatic script, style, and Comment nodes serialize into active markup; (5) cache mutation and DOM parent/child cycles cause infinite loops. Most issues require custom namespace policies or programmatic DOM construction; the default JustHTML(..., sanitize=True) configuration is not affected by most vectors.

## Affected products

- Emil Stenstrom justhtml before 1.17.0

## Identifiers

- CVE-2026-6827
- GHSA-vrx2-77f2-ww34

## Timeline

- 2026-04-19: disclosed
- 2026-04-19: patched: justhtml 1.17.0 released

## References

- [https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-vrx2-77f2-ww34](https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-vrx2-77f2-ww34)
- [https://www.vulncheck.com/advisories/justhtml-before-multiple-cross-site-scripting-vulnerabilities](https://www.vulncheck.com/advisories/justhtml-before-multiple-cross-site-scripting-vulnerabilities)

## Related threats

- [justhtml uncontrolled recursion DoS via deeply nested HTML](https://junglewise.ai/threats/justhtml-uncontrolled-recursion-dos-via-deeply-nested-html-26591bb6)
- [JustHTML uncontrolled recursion DoS via deeply nested HTML](https://junglewise.ai/threats/cve-2026-9769-justhtml-uncontrolled-recursion-dos-via-deeply-nested-html)
- [justhtml mutation XSS in raw-text element serialization](https://junglewise.ai/threats/cve-2026-8630-justhtml-mutation-xss-in-raw-text-element-serialization)
- [justhtml HTML escaping bypass in Markdown conversion](https://junglewise.ai/threats/cve-2026-8445-justhtml-html-escaping-bypass-in-markdown-conversion)
- [justhtml HTML sanitization bypass leading to XSS](https://junglewise.ai/threats/cve-2026-7808-justhtml-html-sanitization-bypass-leading-to-xss)