Description (CNA)
justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in the serialization of raw-text elements such as <style> and <script>. When a DOM tree is processed by sanitize_dom() using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the raw-text context and inject arbitrary HTML into the serialized output. The default sanitization policy is not affected because it drops the contents of style and script.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| EmilStenstrom / justhtml | affected 0 before 1.12.0; unaffected 1.12.0 |
CWE
CWE-79
References
- https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-qvc2-mg72-jjhx
- https://www.vulncheck.com/advisories/justhtml-before-mutation-xss-via-raw-text-elements
ADP enrichment
No English description supplied.
No references supplied.