Get real-time updates on Telegram
P4Verified
CVE-2026-74793: justhtml 0 to before 3.11.0
CVE-2026-74793. CVSS 3.1 base score 6.1 (MEDIUM, Vendor/CNA). EPSS 0.00285 (percentile 0.19399), scored 11-Oct-2026.
Affected technology
justhtml · 0 to before 3.11.0
EmilStenstrom
Description’s affected range: before 3.11.0
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Active user interaction
What an attacker can do
Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling stored or reflected XSS attacks. Vendor/CNA’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality, integrity and availability impact as none.
- CWE
- CWE-79
- CCR priority
- 24.5 /100 (P4)
- CVSS 3.1
- 6.1 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · Vendor/CNA
- EPSS
- 0.00285 · percentile 0.19399 · 2026-10-11
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-12 16:54:24.294989+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-74793.html