EUVD-2026-64651
GHSA-hm7q-2p3r-88q4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Non-default application configuration required to expose attacker input to selector APIs justifies AC:H; impact is availability-only with no confidentiality or integrity consequence.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings (via query(), matches(), or selector-based transforms), run selector matching over very large untrusted documents, construct DOM trees from untrusted structure, or enable linkification over attacker-controlled text may consume disproportionate CPU or memory. Triggers include oversized selectors, large selector lists, oversized compound selectors, long combinator chains, deeply nested functional pseudo-classes, repeated token/positional matching, cyclic DOM graphs causing non-terminating traversal, and punctuation-heavy or trailing-bracket linkification input. These are availability-only concerns and do not by themselves allow script execution, data disclosure, or sanitizer bypass. Default JustHTML(sanitize=True) usage is not expected to be exposed, since selectors are normally supplied by application code.
AnalysisAI
Uncontrolled resource consumption in justhtml before 1.18.0 enables denial-of-service conditions through CPU and memory exhaustion when processing attacker-controlled CSS selectors, large untrusted documents, cyclic DOM graphs, or linkification input. The impact is strictly availability - the advisory explicitly confirms no script execution, data disclosure, or sanitizer bypass is possible. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires one of four specific non-default application conditions: (1) the application accepts attacker-controlled CSS selector strings and passes them to justhtml's query(), matches(), or selector-based transform APIs; (2) the application runs selector matching over attacker-supplied HTML documents without size limits; (3) the application constructs or mutates DOM trees programmatically from untrusted structure, enabling cyclic graph traversal; or (4) the application enables the Linkify feature over attacker-controlled text. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) may overstate real-world risk because AT:N (no attack requirements) does not reflect the advisory's explicit statement that default sanitization configurations are not exposed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a crafted CSS selector string - such as a deeply nested :not(:not(:not(...))) chain, a selector list with thousands of entries, or a long combinator sequence - to a web endpoint that accepts user-supplied selectors and forwards them to justhtml's query() or matches() APIs. The library evaluates the selector without resource bounds, causing the serving process to spin on CPU or exhaust heap memory until the request times out or the process is killed. … |
| Remediation | Upgrade justhtml to version 1.18.0 or later using pip install --upgrade 'justhtml>=1.18.0'; this is the vendor-released patch confirmed by GHSA-r8cj-3554-33mr and is the only complete fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct asset inventory to identify all applications and infrastructure components using JustHTML before version 1.18.0, prioritizing any systems accepting untrusted CSS selectors or HTML linkification input. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Uncontrolled recursion in the justhtml Python HTML parsing library (all versions through 1.9.1) allows any remote unauth
Sanitizer bypass in the justhtml Python library (versions <= 1.11.0) allows attacker-controlled input to survive as raw
Cross-site scripting via HTML sanitization bypass affects justhtml (a Python HTML parsing/sanitization library by EmilSt
Sanitization bypass in justhtml (a Python HTML/Markdown sanitization library) before 1.15.0 lets attacker-controlled inp
Cross-site scripting in justhtml 0.9.0-1.21.0 allows an attacker who can control the text content of HTML code or pre el
Cross-site scripting in justhtml before 3.11.0 allows remote unauthenticated attackers to execute arbitrary JavaScript i
Mutation XSS in justhtml (versions ≤1.11.0) allows injection of arbitrary HTML into serialized output when applications
Mutation XSS (mXSS) in justhtml 1.13.0 and earlier enables markup injection bypass against applications using non-defaul
Cross-site scripting in justhtml versions before 1.13.0 allows attackers who control `<pre>` element content to break ou
Sanitization bypass in justhtml (Python HTML sanitization library) before version 1.17.0 enables cross-site scripting in
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today