CVE-2026-74793
justhtml before 3.11.0 XSS via selectedcontent projection
- State
- Published
- Severity
- 5.1 Medium
- Published
- Aug 23, 2026
- Updated
- Aug 24, 2026
- Reserved
- Aug 16, 2026
Description
justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling stored or reflected XSS attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
justhtmlEmilStenstrom |
|
References
- GitHub Security Advisory (GHSA-gjf2-f4jc-69xf)vendor-advisory
- VulnCheck Advisory: justhtml before 3.11.0 XSS via selectedcontent projectionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.