Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

JustHTML Sanitization Flaw Allows Malicious Code Execution

published 11 days ago
Summary

JustHTML versions 1.14.0 and earlier have a security issue that can allow malicious code to be executed on your website. This is because the software doesn't properly sanitize user input, which means that attackers can inject code that can cause problems. To fix this, update to version 1.15.0 or later.

What to do
  • Update justhtml to version 1.15.0.
  • Update emilstenstrom justhtml to version 1.15.0 or later.
Affected software
Ecosystem VendorProductAffected versions
PyPI – justhtml < 1.15.0
Fix: upgrade to 1.15.0
– emilstenstrom justhtml < 1.15.0
Original advisory text
justhtml before 1.15.0 Multiple Security Issues
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.
References
Severity
9.3 Critical
Type
CWE-178Improper Handling of Case Sensitivity
CWE-20Improper Input Validation
CWE-755Improper Handling of Exceptional Conditions
CWE-79Cross-site Scripting (XSS)
Timeline
Published23 Aug 2026
Updated24 Aug 2026
First seen10 Apr 2026
Sources
GHSA-c9vm-hv86-f23r · OSV
Monitor software like this
Free during beta