justhtml releases up to 1.11.0 allow a mutation cross‑site scripting: when the library serializes a DOM tree with a custom policy that keeps raw‑text elements such as <style> and <script>, the text nodes inside those elements are written literally without escaping. If an attacker injects text that contains a closing tag sequence, it can break out of the raw‑text context and add arbitrary HTML to the output, leading to XSS. The default sanitization policy is not affected because it removes style and script contents entirely.

The vulnerability applies to the justhtml library published by EmilStenstrom. All versions equal to or less than 1.11.0 are affected, while 1.12.0 and later include the fix.

The CVSS score is 5.1, indicating a moderate severity. EPSS data is not provided and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can exploit this flaw when malicious content is processed by an application that uses a customized sanitize_dom() policy keeping raw‑text elements. The likely attack vector is remote, via user‑supplied input to the affected application.