Skip to main content

justhtml EUVDEUVD-2026-64652

| CVE-2026-5388 CRITICAL
Improper Input Validation (CWE-20)
2026-08-23 VulnCheck GHSA-9ph2-9r4x-rhjp
Authentication Bypass Justhtml
9.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.7 MEDIUM

Sanitizer-bypass XSS: attacker-supplied input (PR:N) but exploitation depends on non-default helpers/policies (AC:H) and a victim rendering content (UI:R); injected script crosses into the browser context (S:C) with limited C/I impact and no direct availability effect.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 23, 2026 - 14:16 vuln.today
Analysis Generated
Aug 23, 2026 - 14:16 vuln.today
Patch available
Aug 23, 2026 - 14:01 EUVD
CVE Published
Aug 23, 2026 - 13:34 cve.org
CRITICAL 9.3

DescriptionCVE.org

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript - for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.

AnalysisAI

Sanitization bypass in justhtml (a Python HTML/Markdown sanitization library) before 1.15.0 lets attacker-controlled input reintroduce active HTML and JavaScript, resulting in cross-site scripting in consuming web applications. The flaws span URL-sanitization helpers, HTML serialization, Markdown passthrough, and custom policies - most do NOT affect the default sanitize=True path but do affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft encoded javascript: URL or markup-breaking input
Delivery
Submit to app using affected justhtml helper/passthrough/custom policy
Exploit
Sanitizer accepts malformed value as safe
Execution
Active HTML/JS reintroduced into output
Persist
Victim renders page, script executes in browser
Impact
Session or credential theft
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the consuming application to use one of the affected code paths - specifically: the URL helper APIs JustHTML.clean_url_value()/clean_url_in_js_string(); programmatic DOM/element/attribute construction; Markdown rendering with to_markdown(html_passthrough=True); or custom sanitization policies / transform pipelines (e.g. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) yields 9.3 (critical), but this appears to be a worst-case rating that assumes an application exercising the vulnerable code paths; it materially overstates risk for the common case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A web application uses justhtml's clean_url_value helper (or html_passthrough=True Markdown rendering) to sanitize user-submitted profile bios. An attacker submits a bio containing an entity-encoded 'javascript&#58...' URL or a raw </textarea> break; the sanitizer accepts it as safe, and when another user views the profile the injected script executes in their browser, enabling session theft or actions on their behalf. …
Remediation Vendor-released patch: upgrade justhtml to 1.15.0 (or later) via pip; this is the primary and complete fix per GHSA-c9vm-hv86-f23r. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all internal applications and services using justhtml and document their current versions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Justhtml

View all
CVE-2026-9769 HIGH POC
8.7 Aug 23

Uncontrolled recursion in the justhtml Python HTML parsing library (all versions through 1.9.1) allows any remote unauth
CVE-2026-8445 CRITICAL
9.3 Aug 23

Sanitizer bypass in the justhtml Python library (versions <= 1.11.0) allows attacker-controlled input to survive as raw

CVE-2026-7808 CRITICAL
9.3 Aug 23

Cross-site scripting via HTML sanitization bypass affects justhtml (a Python HTML parsing/sanitization library by EmilSt
CVE-2026-4671 HIGH
8.7 Aug 23

Uncontrolled resource consumption in justhtml before 1.18.0 enables denial-of-service conditions through CPU and memory

CVE-2026-77088 MEDIUM
5.3 Aug 23

Cross-site scripting in justhtml 0.9.0-1.21.0 allows an attacker who can control the text content of HTML code or pre el
CVE-2026-74793 MEDIUM
5.1 Aug 23

Cross-site scripting in justhtml before 3.11.0 allows remote unauthenticated attackers to execute arbitrary JavaScript i
CVE-2026-8630 MEDIUM
5.1 Aug 23

Mutation XSS in justhtml (versions ≤1.11.0) allows injection of arbitrary HTML into serialized output when applications

CVE-2026-5751 MEDIUM
5.1 Aug 23

Mutation XSS (mXSS) in justhtml 1.13.0 and earlier enables markup injection bypass against applications using non-defaul
CVE-2026-5389 MEDIUM
5.1 Aug 23

Cross-site scripting in justhtml versions before 1.13.0 allows attackers who control `<pre>` element content to break ou
CVE-2026-6827 MEDIUM
5.1 Aug 23

Sanitization bypass in justhtml (Python HTML sanitization library) before version 1.17.0 enables cross-site scripting in

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-64652 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy