---
id: CVE-2026-8630
aliases:
  - GHSA-qvc2-mg72-jjhx
title: >-
  JustHTML Affected by Mutation XSS via Literal Text Serialization in Raw Text
  Elements (style/script)
summary: >-
  JustHTML Affected by Mutation XSS via Literal Text Serialization in Raw Text
  Elements (style/script)
severity: medium
vendor: justhtml
product: justhtml
ecosystem: pip
affected:
  - justhtml < 1.12.0
patched:
  - justhtml 1.12.0
published: '2026-03-18'
updated: '2026-08-24'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-qvc2-mg72-jjhx'
references:
  - url: >-
      https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-qvc2-mg72-jjhx
  - url: 'https://github.com/EmilStenstrom/justhtml'
tags:
  - osv
  - pip
epss: 0.00188
epssPercentile: 0.0868
ingestedAt: '2026-08-24T19:25:44.251Z'
---

## Overview

## Summary

Sanitized DOM trees can be unsafe to serialize when a custom policy allows raw-text elements such as `<style>` or `<script>`.

The issue affects DOM trees that are constructed or modified programmatically and then passed through `sanitize_dom()` with a policy that keeps these elements. Text nodes inside `<style>` and `<script>` are serialized literally, so attacker-controlled text containing the matching closing tag sequence can break out of the raw-text context and inject HTML into the serialized output.

The default sanitization policy is not affected because it drops the contents of `style` and `script`.

## Details

The root cause is in HTML serialization of raw-text elements. In serialize.py, text children of `script` and `style` are emitted verbatim:

```python
_LITERAL_TEXT_SERIALIZATION_ELEMENTS = frozenset({"script", "style"})

def _serialize_text_for_parent(text: str | None, parent_name: str | None) -> str:
    if not text:
        return ""
    if parent_name in _LITERAL_TEXT_SERIALIZATION_ELEMENTS:
        return text
    return _escape_text(text)

## Affected packages

- `justhtml < 1.12.0`

## Remediation

Upgrade to a patched release:

- `justhtml 1.12.0`