CVE-2026-74793 in justhtml before 3.11.0 is a stored XSS vulnerability where event handlers survive DOM node cloning in the selectedcontent feature. The key insight is that this is not a signature-matching failure — the sanitizer works correctly during the initial parse. The flaw is architectural: the selectedcontent projection clones DOM nodes and reinserts them into output without passing through any sanitization stage. The security boundary was drawn around parsing, not around content transformation. This means the original parsed HTML may be clean, but the cloned output is not.
SVG and MathML are the vectors because these namespaces support inline event handler attributes that slip through parsers designed primarily for HTML. When selectedcontent clones a node containing, for example, an SVG element with an onload handler, that handler persists in the output. This is a stored XSS condition — the malicious payload is stored in the document and executes when any user views the projected content.
The selectedcontent feature exists to display selected document regions — think 'you highlighted X' in a CMS or note-taking app. This creates a potent social engineering vector: the victim triggers their own exploitation through normal, expected interaction. The CVSS 6.1 rating seems conservative for a stored XSS with this profile.
This vulnerability likely represents a class rather than an isolated instance. The pattern — sanitizer at parse time, bypass during DOM cloning or serialization — has recurred across ecosystems for over a decade. When this CVE becomes public, expect isomorphic findings in other libraries that implemented the same architectural assumption. Treat this as evidence of a broader gap, not a one-off bug.
For defenders: verify whether any content projection, serialization, or DOM cloning paths exist in your justhtml usage. If selectedcontent is in the processing chain, treat any user-selected content as untrusted until the clone path is patched. The library's semantic name creates an expectation of end-to-end sanitization — audit whether that expectation matches reality in your integration.