2 matches found
EUVD-2026-64656
justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...
6.1CVSS4.9AI score0.00285EPSS
SaveExploits0References2
CVE-2026-74793 justhtml before 3.11.0 XSS via selectedcontent projection
justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...
5.1CVSS5AI score
SaveExploits0References4
20