EUVD-2026-64661
GHSA-892m-gcq8-2468
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated DoS with no confidentiality or integrity impact; scope unchanged as only the vulnerable process is affected.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.
AnalysisAI
Uncontrolled recursion in the justhtml Python HTML parsing library (all versions through 1.9.1) allows any remote unauthenticated attacker who can supply HTML input to trigger a denial of service via stack exhaustion. Approximately 1,000 nested HTML elements (~11 KB of crafted input) are sufficient to exceed CPython's default recursion limit of 1,000 frames during DOM traversal in TreeBuilder._find_elements(), raising an unhandled RecursionError that can abort parsing, fail requests, or terminate a worker process depending on framework error handling. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application accepts HTML content from attacker-controlled input (e.g., a user-submitted form field, an API body, or a URL-fetched document) and passes it directly to the JustHTML() constructor without pre-filtering for nesting depth or element count. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 8.7) accurately reflects this vulnerability: the attack is network-reachable, requires no authentication, imposes no complexity barrier, and delivers high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a crafted HTTP POST body containing approximately 1,000 nested <div> tags (~11 KB) to any endpoint that passes the request body or a form field to JustHTML() for parsing. The application invokes JustHTML(attacker_html), which triggers the unbounded _find_elements() recursion; when the call stack hits CPython's 1,000-frame limit, an unhandled RecursionError is raised. … |
| Remediation | Upgrade justhtml to version 1.10.0 or later using pip install --upgrade justhtml; this is the definitive fix as confirmed by the vendor advisory at https://github.com/EmilStenstром/justhtml/security/advisories/GHSA-v7cf-c9rm-wm3j. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications and services using justhtml through version 1.9.1 and document their business criticality; flag this as a high-priority patch task for security and engineering teams. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Sanitizer bypass in the justhtml Python library (versions <= 1.11.0) allows attacker-controlled input to survive as raw
Cross-site scripting via HTML sanitization bypass affects justhtml (a Python HTML parsing/sanitization library by EmilSt
Sanitization bypass in justhtml (a Python HTML/Markdown sanitization library) before 1.15.0 lets attacker-controlled inp
Uncontrolled resource consumption in justhtml before 1.18.0 enables denial-of-service conditions through CPU and memory
Cross-site scripting in justhtml 0.9.0-1.21.0 allows an attacker who can control the text content of HTML code or pre el
Cross-site scripting in justhtml before 3.11.0 allows remote unauthenticated attackers to execute arbitrary JavaScript i
Mutation XSS in justhtml (versions ≤1.11.0) allows injection of arbitrary HTML into serialized output when applications
Mutation XSS (mXSS) in justhtml 1.13.0 and earlier enables markup injection bypass against applications using non-defaul
Cross-site scripting in justhtml versions before 1.13.0 allows attackers who control `<pre>` element content to break ou
Sanitization bypass in justhtml (Python HTML sanitization library) before version 1.17.0 enables cross-site scripting in
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today