---
id: CVE-2026-74793
title: >-
  justhtml before 3.11.0 contains a cross-site scripting vulnerability where the
  default sanitizer bypasses event handler removal in selectedcontent
  projections
summary: >-
  justhtml before 3.11.0 contains a cross-site scripting vulnerability where the
  default sanitizer bypasses event handler removal in selectedcontent
  projections. Attackers can inject SVG or MathML elements with event handlers
  that are clon…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2026-08-23'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T16:10:00.220'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74793'
references:
  - url: >-
      https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-gjf2-f4jc-69xf
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/justhtml-before-xss-via-selectedcontent-projection
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-gjf2-f4jc-69xf
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00285
epssPercentile: 0.19417
ingestedAt: '2026-10-12T16:57:59.894Z'
---

## Overview

justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling stored or reflected XSS attacks.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.