justhtml CVE-2026-5388

Exploitation requires the consuming application to use one of the affected code paths - specifically: the URL helper APIs JustHTML.clean_url_value()/clean_url_in_js_string(); programmatic DOM/element/attribute construction; Markdown rendering with to_markdown(html_passthrough=True); or custom sanitization policies / transform pipelines (e.g. those preserving <style>, <meta http-equiv=refresh>, <base href>, or using DropAttrs/DropUrlAttrs/AllowStyleAttrs/MergeAttrs). The key limiting factor: the default sanitize=True configuration is largely NOT affected, so applications using justhtml's standard sanitizer with default policy are mostly out of scope. Additional limits: successful XSS requires a victim to render the attacker-controlled content, and impact is scoped to the browser/DOM context of the target application. Authentication requirements are not independently confirmable from the description; the CVSS vector lists PR:N (unauthenticated attacker input), but real exposure depends on where untrusted input reaches an affected code path.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) yields 9.3 (critical), but this appears to be a worst-case rating that assumes an application exercising the vulnerable code paths; it materially overstates risk for the common case. The description and GHSA advisory are explicit that most issues do NOT affect the default sanitize=True configuration and primarily impact helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines - a strong mitigating factor the raw score ignores. This is a genuine sanitizer-bypass/XSS class issue rather than direct server compromise, so VC/VI/VA:H (high confidentiality/integrity/availability of the vulnerable system) is optimistic for what is functionally client-side script injection; UI:N is also questionable since XSS typically requires a victim to render the content. There is no KEV listing and no EPSS score in the provided data, and no POC was supplied, so there is no evidence of active or widespread exploitation. Net assessment: a real bug worth patching promptly for anyone using the affected non-default paths, but not a drop-everything internet-wide emergency for default-configuration users; prioritize based on whether your application actually calls the affected helpers or custom policies.

A web application uses justhtml's clean_url_value helper (or html_passthrough=True Markdown rendering) to sanitize user-submitted profile bios. An attacker submits a bio containing an entity-encoded 'javascript&#58...' URL or a raw </textarea> break; the sanitizer accepts it as safe, and when another user views the profile the injected script executes in their browser, enabling session theft or actions on their behalf. No public exploit code is currently identified, but the bypass techniques are described in detail in the advisory.