justhtml CVE-2026-9769

Exploitation requires that the target application accepts HTML content from attacker-controlled input (e.g., a user-submitted form field, an API body, or a URL-fetched document) and passes it directly to the JustHTML() constructor without pre-filtering for nesting depth or element count. The host runtime must be CPython - the vulnerability depends on CPython's default recursion limit of 1,000 frames; runtimes with higher limits or tail-call optimization would require proportionally deeper nesting. No authentication is required, no non-default configuration is needed, and no specific operating system or platform is required beyond a standard CPython install with justhtml <= 1.9.1. Exploitation is strictly limited to denial-of-service; no code execution or data disclosure is possible. The real-world limiting factor is application-layer exposure: services that only parse internally generated or pre-validated HTML are not reachable via this vector.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 8.7) accurately reflects this vulnerability: the attack is network-reachable, requires no authentication, imposes no complexity barrier, and delivers high availability impact. The attack is highly automatable - a static ~11 KB payload reliably triggers the crash regardless of application state. Real-world risk is bounded by two factors: first, only applications that pass externally supplied HTML to JustHTML() are in scope; second, justhtml is a niche Python library with a limited production footprint, substantially narrowing the population of reachable targets. No EPSS data was provided in the source intelligence, so exploitation probability cannot be quantified beyond what the CVSS vector implies. The vulnerability is not listed in CISA KEV, and no formal POC repository has been identified, though the GHSA advisory references exact file paths, line numbers, call chains, and payload size - sufficient for any competent practitioner to reproduce without further research. The fix is available as version 1.10.0, and the upgrade path is straightforward. Applications that sanitize or restrict HTML input depth prior to parsing, or that do not accept untrusted HTML, are not at practical risk.

An attacker submits a crafted HTTP POST body containing approximately 1,000 nested <div> tags (~11 KB) to any endpoint that passes the request body or a form field to JustHTML() for parsing. The application invokes JustHTML(attacker_html), which triggers the unbounded _find_elements() recursion; when the call stack hits CPython's 1,000-frame limit, an unhandled RecursionError is raised. Depending on whether the host framework catches the exception, this either returns a 500 error to the attacker (failing the request) or terminates the worker process, potentially taking all concurrent requests offline.