Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-5388: JustHTML versions 1.15.0 fixes security flaws in URL sanitization and HTML generation
CVE-2026-5388 · published 11 days ago
Summary
JustHTML versions prior to 1.15.0 have security flaws in URL sanitization and HTML generation. These flaws could allow malicious code to be injected into websites, potentially allowing attackers to steal user data or take control of user sessions. To fix these issues, update to JustHTML version 1.15.0 or later.
What to do
- Update justhtml to version 1.15.0.
- Update emilstenstrom justhtml to version 1.15.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | – | justhtml |
<= 1.14.0 Fix: upgrade to 1.15.0
|
| – | emilstenstrom | justhtml | < 1.15.0 |
Original advisory text
justhtml before 1.15.0 Multiple Security Issues
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.
References
- https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-c9vm-hv86-f23...
- https://github.com/EmilStenstrom/justhtml/releases/tag/v1.15.0
- https://github.com/advisories/GHSA-c9vm-hv86-f23r
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5388.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-5388 Vendor Advisory
- https://www.vulncheck.com/advisories/justhtml-before-multiple-security-issues Vendor Advisory
Severity
9.9
Critical
CVSS 3.1: 9.8 (NVD)
CVSS 4.0: 9.3 (NVD)
Exploitation
EPSS <1%
Type
CWE-20Improper Input Validation
CWE-79Cross-site Scripting (XSS)
CWE-178Improper Handling of Case Sensitivity
CWE-755Improper Handling of Exceptional Conditions
Timeline
Published23 Aug 2026
Updated2 Sep 2026
First seen10 Apr 2026
Monitor software like this
Free during beta