justhtml CVE-2026-4671

Exploitation requires one of four specific non-default application conditions: (1) the application accepts attacker-controlled CSS selector strings and passes them to justhtml's query(), matches(), or selector-based transform APIs; (2) the application runs selector matching over attacker-supplied HTML documents without size limits; (3) the application constructs or mutates DOM trees programmatically from untrusted structure, enabling cyclic graph traversal; or (4) the application enables the Linkify feature over attacker-controlled text. The vendor's advisory explicitly states that default JustHTML(sanitize=True) usage is not expected to expose untrusted selectors because selectors are normally supplied by application code. Factors limiting exploitation: impact is purely availability with no confidentiality or integrity consequence; non-default configuration is required in all attack paths; and the library must be reachable via a network-exposed endpoint processing attacker input in one of these modes.

The vendor-assigned CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) may overstate real-world risk because AT:N (no attack requirements) does not reflect the advisory's explicit statement that default sanitization configurations are not exposed. Exploitation requires a specific non-default application design - one that passes attacker-controlled selector strings to query() or matches(), enables Linkify over untrusted text, or constructs DOM trees from untrusted structure. A more precise CVSS 4.0 model would assign AT:P, and CVSS 3.1 AC:H, materially lowering the score. EPSS data is absent from the provided intelligence and cannot be quantified. No CISA KEV listing exists and no public exploit code has been identified, making opportunistic mass exploitation implausible. The realistic threat is a targeted DoS against a narrow class of custom applications using non-default justhtml features. Priority is moderate for affected deployments and low for the broader Python ecosystem.

An attacker submits a crafted CSS selector string - such as a deeply nested :not(:not(:not(...))) chain, a selector list with thousands of entries, or a long combinator sequence - to a web endpoint that accepts user-supplied selectors and forwards them to justhtml's query() or matches() APIs. The library evaluates the selector without resource bounds, causing the serving process to spin on CPU or exhaust heap memory until the request times out or the process is killed. No public exploit code has been identified at time of analysis, though the triggering patterns are fully disclosed in the advisory, making reproduction straightforward for a researcher or attacker with library access.