Five justhtml Vulnerabilities: Sanitization Boundaries and Response

Five flaws across different trust boundaries

The five CVEs handed off for this article affect different parts of justhtml: DOM sanitization, mutable policies, URL handling, HTML serialization, Markdown conversion, and the selectedcontent projection path. Treating them as one generic XSS bug would hide the operational question that matters most: which conversion path does each application actually use?

CVE-2026-7808 covers issues fixed in 1.16.0 around programmatic DOM input, mutable sanitization policy state, serialization, and custom policies that preserve SVG or MathML. CVE-2026-8445 affects Markdown conversion through 1.11.0, where text that looks like HTML can become active after another Markdown renderer processes the output. CVE-2026-5388 covers URL helpers, serializer behavior, Markdown passthrough, and custom-policy edge cases fixed in 1.15.0.

Markdown and default-sanitizer paths

CVE-2026-77088 affects versions 0.9.0 through 1.21.0. A blank line can terminate an inline Markdown code span, leaving attacker-controlled text to be interpreted again as raw HTML or Markdown. Version 1.22.0 fixes that boundary. CVE-2026-74793 reaches the documented default sanitization path: selectedcontent projection can clone a foreign-content subtree after deferred sanitization decisions have been recorded, allowing active SVG or MathML attributes to reappear. The advisory identifies 3.11.0 as the fixed release.

Operational review

• Inventory deployed justhtml versions in lock files, images, and SBOMs.
• Separate HTML sanitization, programmatic DOM, URL helper, Markdown conversion, and Markdown re-rendering call sites.
• Remove mutation or reuse of exported default-policy internals.
• Review policies that preserve SVG, MathML, style, base, refresh, and URL-bearing attributes.
• Test both the immediate output and any downstream renderer after upgrading.

Version strategy

The fixed boundaries differ: 1.12.0, 1.15.0, 1.16.0, 1.22.0, and 3.11.0. A service that uses several affected features should converge on a supported current release rather than selecting one patch in isolation. Verify the resolved dependency in the deployed artifact, then run security regression tests across the complete parse-sanitize-serialize-render pipeline.

Verification time

Sources were rechecked for the missed August 24, 2026 14:00 KST cycle. The public recommendations follow the affected paths and fixed releases stated in the justhtml GitHub security advisories.