# CVE-2026-7808: justhtml HTML sanitization bypass leading to XSS

Source: https://junglewise.ai/threats/cve-2026-7808-justhtml-html-sanitization-bypass-leading-to-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-7808 · Severity: critical · CVSS 9.8 · Published 2026-08-23

justhtml is a Python library that sanitizes HTML to prevent malicious content like scripts and styles from being executed. A flaw in versions before 1.16.0 allows dangerous content to survive sanitization under certain conditions, potentially enabling attackers to inject and execute malicious scripts. This could allow attackers to steal user data, session cookies, or perform actions on behalf of users.

Technologies: [justhtml (PyPI)](https://junglewise.ai/threats/technologies/justhtml). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-7808 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7808 being exploited in the wild.

**How severe is CVE-2026-7808?** Critical severity, with a CVSS score of 9.8, published 23 August 2026.

**Which products and versions are affected?** justhtml (PyPI) ECOSYSTEM:introduced=0,fixed=1.16.0.

**Is there a fix for CVE-2026-7808?** Yes. justhtml (PyPI): upgrade to 1.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-7808 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-7808?** Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- justhtml (PyPI): upgrade to 1.16.0 or later

  ```sh
  pip install "justhtml>=1.16.0"
  ```


## Technical details

justhtml before 1.16.0 contains multiple HTML sanitization bypass vulnerabilities (CWE-20, CWE-79, CWE-178, CWE-436, CWE-471) that allow active/dangerous content to survive sanitization and lead to cross-site scripting (XSS). The vulnerabilities include: (1) mutation or reuse of sanitization policy objects weakening later sanitization; (2) programmatic DOM input missing mixed-case tag names (e.g., ScRiPt, StYlE); (3) crafted doctype names serializing into active markup; and (4) custom policies preserving SVG or MathML allowing animation elements, external url() references, or mislabeled DOM trees to bypass foreign-content checks. These issues primarily affect advanced usage paths rather than the default JustHTML(..., sanitize=True) configuration for ordinary parsed HTML. The vulnerability is fixed in version 1.16.0.

## Affected products

- Emil Stenstrom justhtml before 1.16.0

## Identifiers

- CVE-2026-7808
- GHSA-4p64-v8f5-r2gx

## Timeline

- 2026-04-12: disclosed: Security advisory GHSA-4p64-v8f5-r2gx published
- 2026-04-12: patched: Version 1.16.0 released with fixes
- 2026-08-23: advisory: CVE-2026-7808 assigned and published on NVD

## References

- [https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-4p64-v8f5-r2gx](https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-4p64-v8f5-r2gx)
- [https://www.vulncheck.com/advisories/justhtml-before-multiple-security-issues-via-sanitization](https://www.vulncheck.com/advisories/justhtml-before-multiple-security-issues-via-sanitization)

## Related threats

- [justhtml uncontrolled recursion DoS via deeply nested HTML](https://junglewise.ai/threats/justhtml-uncontrolled-recursion-dos-via-deeply-nested-html-26591bb6)
- [JustHTML uncontrolled recursion DoS via deeply nested HTML](https://junglewise.ai/threats/cve-2026-9769-justhtml-uncontrolled-recursion-dos-via-deeply-nested-html)
- [justhtml mutation XSS in raw-text element serialization](https://junglewise.ai/threats/cve-2026-8630-justhtml-mutation-xss-in-raw-text-element-serialization)
- [justhtml HTML escaping bypass in Markdown conversion](https://junglewise.ai/threats/cve-2026-8445-justhtml-html-escaping-bypass-in-markdown-conversion)
- [justhtml to_markdown() cross-site scripting in code span](https://junglewise.ai/threats/cve-2026-77088-justhtml-to-markdown-cross-site-scripting-in-code-span)