justhtml before version 1.16.0 contains multiple sanitization bypass bugs that allow active or dangerous HTML, such as <script> or <style> elements, to remain in the sanitized output. These flaws stem from insufficient input validation (CWE‑20) and are limited to the content that the library processes. The result is client‑side script execution (cross‑site scripting) when a malicious payload is rendered in a browser, without providing the attacker with the to execute arbitrary code on the server.

Any environment that imports, renders, or stores user‑supplied HTML through justhtml on a release earlier than 1.16.0 is affected. This includes web applications, content management systems, or services that depend on justhtml for escaping or sanitizing HTML prior to display.

The CVSS score of 9.3 marks the issue as critical. With no EPSS score reported and the vulnerability not listed in the CISA KEV catalog, the public exploit evidence is low but the attack surface remains high for applications that allow untrusted input and use advanced policy features. An attacker that can control the data passed to JustHTML can craft HTML that bypasses mixed‑case tag checks, manipulated doctype handling, or custom SVG/MathML policies to inject malicious scripts, resulting in a cross‑site scripting event for the end user.