Is CVE-2026-7808 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7808 being exploited in the wild.

How severe is CVE-2026-7808?

Critical severity, with a CVSS score of 9.8, published 23 August 2026.

Which products and versions are affected?

justhtml (PyPI) ECOSYSTEM:introduced=0,fixed=1.16.0.

Is there a fix for CVE-2026-7808?

Yes. justhtml (PyPI): upgrade to 1.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-7808 attacked?

It is attacked over the network.

Am I affected by CVE-2026-7808?

Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7808: justhtml HTML sanitization bypass leading to XSS

CVE-2026-7808 · Severity: critical · CVSS 9.8 · Published 2026-08-23

justhtml is a Python library that sanitizes HTML to prevent malicious content like scripts and styles from being executed. A flaw in versions before 1.16.0 allows dangerous content to survive sanitization under certain conditions, potentially enabling attackers to inject and execute malicious scripts. This could allow attackers to steal user data, session cookies, or perform actions on behalf of users.

Technologies: justhtml (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-7808 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7808 being exploited in the wild.
How severe is CVE-2026-7808?: Critical severity, with a CVSS score of 9.8, published 23 August 2026.
Which products and versions are affected?: justhtml (PyPI) ECOSYSTEM:introduced=0,fixed=1.16.0.
Is there a fix for CVE-2026-7808?: Yes. justhtml (PyPI): upgrade to 1.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7808 attacked?: It is attacked over the network.
Am I affected by CVE-2026-7808?: Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

justhtml (PyPI): upgrade to 1.16.0 or later
```
pip install "justhtml>=1.16.0"
```

Technical details

justhtml before 1.16.0 contains multiple HTML sanitization bypass vulnerabilities (CWE-20, CWE-79, CWE-178, CWE-436, CWE-471) that allow active/dangerous content to survive sanitization and lead to cross-site scripting (XSS). The vulnerabilities include: (1) mutation or reuse of sanitization policy objects weakening later sanitization; (2) programmatic DOM input missing mixed-case tag names (e.g., ScRiPt, StYlE); (3) crafted doctype names serializing into active markup; and (4) custom policies preserving SVG or MathML allowing animation elements, external url() references, or mislabeled DOM trees to bypass foreign-content checks. These issues primarily affect advanced usage paths rather than the default JustHTML(..., sanitize=True) configuration for ordinary parsed HTML. The vulnerability is fixed in version 1.16.0.

Affected products

Emil Stenstrom justhtml before 1.16.0

Identifiers

CVE-2026-7808
GHSA-4p64-v8f5-r2gx

Timeline

2026-04-12: disclosed: Security advisory GHSA-4p64-v8f5-r2gx published
2026-04-12: patched: Version 1.16.0 released with fixes
2026-08-23: advisory: CVE-2026-7808 assigned and published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.