{"id":"CVE-2026-8630","aliases":["GHSA-qvc2-mg72-jjhx"],"title":"JustHTML Affected by Mutation XSS via Literal Text Serialization in Raw Text Elements (style/script)","summary":"JustHTML Affected by Mutation XSS via Literal Text Serialization in Raw Text Elements (style/script)","severity":"medium","vendor":"justhtml","product":"justhtml","ecosystem":"pip","affected":["justhtml < 1.12.0"],"patched":["justhtml 1.12.0"],"published":"2026-03-18","updated":"2026-08-24","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-qvc2-mg72-jjhx","references":[{"url":"https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-qvc2-mg72-jjhx"},{"url":"https://github.com/EmilStenstrom/justhtml"}],"tags":["osv","pip"],"epss":0.00188,"epssPercentile":0.08663,"ingestedAt":"2026-08-24T19:25:44.251Z","slug":"CVE-2026-8630","body":"## Overview\n\n## Summary\n\nSanitized DOM trees can be unsafe to serialize when a custom policy allows raw-text elements such as `<style>` or `<script>`.\n\nThe issue affects DOM trees that are constructed or modified programmatically and then passed through `sanitize_dom()` with a policy that keeps these elements. Text nodes inside `<style>` and `<script>` are serialized literally, so attacker-controlled text containing the matching closing tag sequence can break out of the raw-text context and inject HTML into the serialized output.\n\nThe default sanitization policy is not affected because it drops the contents of `style` and `script`.\n\n## Details\n\nThe root cause is in HTML serialization of raw-text elements. In serialize.py, text children of `script` and `style` are emitted verbatim:\n\n```python\n_LITERAL_TEXT_SERIALIZATION_ELEMENTS = frozenset({\"script\", \"style\"})\n\ndef _serialize_text_for_parent(text: str | None, parent_name: str | None) -> str:\n    if not text:\n        return \"\"\n    if parent_name in _LITERAL_TEXT_SERIALIZATION_ELEMENTS:\n        return text\n    return _escape_text(text)\n\n## Affected packages\n\n- `justhtml < 1.12.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `justhtml 1.12.0`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}