https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 16:18:59 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-6827 <p>justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces (SVG/MathML), dangerous content such as HTML integration points (SVG &lt;foreignObject&gt;, MathML &lt;annotation-xml encoding=&#34;text/html&#34;&gt;) and mutation-XSS parser-differential payloads could survive sanitization and become active HTML after reparse; SVG filter=&#34;url(...)&#34; and preserved &lt;style&gt; could leave resource-loading CSS (@import, background-image:url()). Programmatic script/style/Comment nodes could serialize into active markup. Additional hardening fixes address sanitize-pipeline cache mutation and DOM parent/child cycles that could cause infinite loops. Most issues affect advanced or custom configurations rather than the default JustHTML(..., sanitize=True) safe path.</p> <p>justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces (SVG/MathML), dangerous content such as HTML integration points (SVG &lt;foreignObject&gt;, MathML &lt;annotation-xml encoding=&#34;text/html&#34;&gt;) and mutation-XSS parser-differential payloads could survive sanitization and become active HTML after reparse; SVG filter=&#34;url(...)&#34; and preserved &lt;style&gt; could leave resource-loading CSS (@import, background-image:url()). Programmatic script/style/Comment nodes could serialize into active markup. Additional hardening fixes address sanitize-pipeline cache mutation and DOM parent/child cycles that could cause infinite loops. Most issues affect advanced or custom configurations rather than the default JustHTML(..., sanitize=True) safe path.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-6827 https://vulnerability.circl.lu/vuln/ghsa-f8m6-5gph-fw7f <p>justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces (SVG/MathML), dangerous content such as HTML integration points (SVG &lt;foreignObject&gt;, MathML &lt;annotation-xml encoding=&#34;text/html&#34;&gt;) and mutation-XSS parser-differential payloads could survive sanitization and become active HTML after reparse; SVG filter=&#34;url(...)&#34; and preserved &lt;style&gt; could leave resource-loading CSS (@import, background-image:url()). Programmatic script/style/Comment nodes could serialize into active markup. Additional hardening fixes address sanitize-pipeline cache mutation and DOM parent/child cycles that could cause infinite loops. Most issues affect advanced or custom configurations rather than the default JustHTML(..., sanitize=True) safe path.</p> <p>justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces (SVG/MathML), dangerous content such as HTML integration points (SVG &lt;foreignObject&gt;, MathML &lt;annotation-xml encoding=&#34;text/html&#34;&gt;) and mutation-XSS parser-differential payloads could survive sanitization and become active HTML after reparse; SVG filter=&#34;url(...)&#34; and preserved &lt;style&gt; could leave resource-loading CSS (@import, background-image:url()). Programmatic script/style/Comment nodes could serialize into active markup. Additional hardening fixes address sanitize-pipeline cache mutation and DOM parent/child cycles that could cause infinite loops. Most issues affect advanced or custom configurations rather than the default JustHTML(..., sanitize=True) safe path.</p> https://vulnerability.circl.lu/vuln/ghsa-f8m6-5gph-fw7f