The vulnerability is a cross‑site scripting flaw in versions of justhtml before 3.11.0. The library’s default sanitizer accidentally allows event handlers on SVG or MathML elements to survive the selectedcontent projection, so attackers can inject malicious code that is later rendered and executed. This enables stored or reflected XSS, letting a threat actor run arbitrary JavaScript in the victim’s browser, compromising confidentiality, integrity, and potentially the availability of the web application.

The affected product is justhtml, developed by Emil Stenstrom. All releases prior to 3.11.0 are vulnerable because the default configuration does not strip event handlers from selectedcontent projections. Upgrade notes are not included in the data, but the advisory indicates the issue applies to any version before the 3.11.0 release.

The CVSS score of 5.1 classifies the flaw as medium severity. No EPSS score is available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers would need a way to inject crafted SVG/MathML into content that passes through the sanitizer’s selectedcontent projection. The likely vector is a web interface that accepts user supplied content; detection would be possible with proper sanitation or path filtering.