AIKIDO-2026-758189

TL;DR

Selma streams sanitized HTML byte-for-byte and does not escape a literal < that the tokenizer classifies as text, for example in <<b>. When the sanitizer then removes an adjacent disallowed element, unknown element, or comment, the unescaped < fuses with the surrounding text and re-parses as a real tag in the browser, producing a mutation XSS that bypasses the second-pass tagfilter for tags outside its fixed list. All built-in sanitizer configurations and custom configurations are affected. The fix escapes literal < in entity-decoding text contexts so text stays text regardless of what the sanitizer removes around it.