CVE-2026-8630

CVE-2026-8630 is an mXSS in justhtml, but the vulnerability is not in the sanitizer — it's in the serializer. Understanding this distinction is critical for anyone maintaining downstream code. The function sanitize_dom() does what its name implies: it walks a DOM tree and applies a policy to remove dangerous content. If your policy preserves style or script elements (a common requirement for applications that need to render user-authored styling), the sanitizer correctly keeps those elements and their text content intact in the DOM tree. The problem emerges when that tree is later serialized back to HTML using serialize_dom() or an equivalent mechanism. During serialization, text nodes inside raw-text contexts (like style elements) are dumped literally — no escaping, no encoding. An attacker who injects `</style>` into a style element's text node doesn't need to break out of the tag themselves; the serializer does it for them. This creates a dangerous false premise: a developer using a custom policy to preserve style elements has done nothing wrong at the sanitizer level, yet their output is vulnerable the moment serialization enters the picture. The sanitizer maintained its invariant; the serializer violated it. The CVSS 6.1 score badly understates the exposure because it measures the library in isolation, not the integration point. sanitize_dom() sits at a chokepoint that dozens of downstream sanitizers and frameworks depend on. Anyone who takes justhtml's DOM tree output and serializes it — even through a different library — inherits this risk. Before the 1.12.0 patch, the mitigation was not to use custom policies preserving raw-text elements. After 1.12.0, verify what the patch actually changes: if it modifies serialize_dom() behavior, callers using custom serialization paths may still be vulnerable. Audit your dependency graph. If your codebase wraps justhtml and exposes the sanitized tree to any serialization step, you are in the blast radius. The deeper architectural question is whether any sanitizer that preserves raw-text elements while delegating serialization to a separate library is operating on a false premise — and whether your codebase contains such a pattern.

Reviewed through automated stages and approved by a human before publication.