CVE-2026-5751 is a mutation XSS (mXSS) vulnerability in justhtml that exploits a fundamental mismatch between the sanitizer's parser model and the browser's parser when SVG or MathML foreign content contexts are involved. The vulnerability is not in the sanitizer's logic itself—the library correctly identifies and neutralizes dangerous markup—but in how browsers re-parse that sanitized output when namespace contexts are preserved. This reconstructs the original attack payload from safe-looking markup.
Exploitation requires a specific configuration: you must be using a custom SanitizationPolicy with drop_foreign_namespaces=False (or its equivalent). This is not the default. However, this configuration directly serves the legitimate use case of allowing embedded SVG graphics or mathematical notation in user-generated content, making it a common production choice.
What you should check: Audit any justhtml deployment for custom SanitizationPolicy configuration. Search for options that preserve foreign namespaces, SVG allowlists, or MathML permissions. If your deployment uses these, you are in the vulnerable configuration path regardless of whether you've explicitly allowed dangerous elements—the parser differential bypasses your allowlist entirely.
What you should do: The 1.14.0 patch presumably modifies this behavior. Upgrade and test thoroughly. If you cannot upgrade immediately, treat any output containing SVG or MathML as potentially unsafe and re-sanitize it with an independent layer (like DOMPurify) that is explicitly configured to handle parser differentials. Do not rely on the assumption that 'pre-sanitized HTML is safe' when that output may be re-parsed by downstream systems—mail clients, search indexers, content pipelines, and markdown processors all create new parsing contexts where the bypass can reconstruct.
The CVSS 6.1 score reflects the non-default configuration requirement, which is reasonable for aggregate risk. But this vulnerability has a documented genealogy: the same pattern—'allowlist your SVG elements' configuration creating mXSS bypass—has appeared in DOMPurify, Angular's sanitizer, and Caja over fifteen years. Each time the response is a medium-score patch and documentation update. The pattern suggests the configuration path itself is structurally incompatible with safe sanitization guarantees, not merely a local implementation error. If your system consumes content from justhtml deployments you don't control, consider adding your own sanitization layer regardless of what the upstream service reports.