justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML(..., sanitize=True) path for ordinary parsed HTML: mutating or reusing sanitization policy objects (including exported defaults) could weaken later sanitization; programmatic DOM input to sanitize()/sanitize_dom() could miss mixed-case tag names (e.g., ScRiPt, StYlE); crafted programmatic doctype names could serialize into active markup; and custom policies preserving SVG or MathML could allow animation elements, presentation attributes with external url(...) references, or DOM trees mislabeled as namespace="html" to bypass foreign-content checks. Fixed in 1.16.0.

The justhtml Python library before version 1.16.0 contains multiple HTML sanitization bypass vulnerabilities that can allow dangerous content such as scripts or styles to survive sanitization, potentially leading to cross-site scripting (XSS). The issues primarily affect advanced usage scenarios rather than the default sanitization path. Specific bypass vectors include: mutating or reusing sanitization policy objects weakening later sanitization; programmatic DOM input missing mixed-case tag names like ScRiPt or StYlE; crafted doctype names serializing into active markup; and custom policies preserving SVG or MathML allowing animation elements, external URL references in presentation attributes, or DOM trees mislabeled with namespace='html' to bypass foreign-content checks. The vulnerabilities are fixed in justhtml version 1.16.0. Users relying on custom or programmatic sanitization policies are most at risk.