VYPR
← All advisories
Medium severity6.1OSV Advisory· Published Aug 23, 2026· Updated Aug 26, 2026

CVE-2026-74793

CVE-2026-74793

Description

justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling stored or reflected XSS attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Emilstenstrom/JusthtmlOSV2 versions
    v3.10.1, v3.10.0, v3.9.0, …+ 1 more
    • (no CPE)range: v3.10.1, v3.10.0, v3.9.0, …
    • (no CPE)range: <3.11.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.