PT-2026-79774

Name of the Vulnerable Software and Affected Versions justhtml versions 0.9.0 through 1.21.0 Description A cross-site scripting issue exists in the to markdown function. The problem occurs because inline code spans do not recognize blank lines as block boundaries. This allows attackers to inject...

Infinite loop

Overview justhtml is an A pure Python HTML5 parser that just works. Affected versions of this package are vulnerable to Infinite loop in the handling of CSS selectors and linkification processes. An attacker can cause excessive CPU or memory consumption by supplying specially crafted selector...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.14.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: SNYK:PYTHON-JUSTHTML-16635077...

any2htpy (0.1.4) potentially affected by CVE-2026-4671 via justhtml (0.35.0)

justhtml PYPI version 0.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on justhtml and may be impacted: - any2htpy 0.1.4 Source cves: CVE-2026-4671 Source advisory: OSV:GHSA-R8CJ-3554-33MR...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by CVE-2026-4671 via justhtml (>=1.1.0, <=1.14.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: CVE-2026-4671 Source advisory: OSV:GHSA-R8CJ-3554-33MR...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.14.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: GHSA-R8CJ-3554-33MR...

GHSA-R8CJ-3554-33MR justhtml introduces denial-of-service hardening

Summary justhtml 1.18.0 fixes multiple low-severity denial-of-service hardening issues in CSS selector handling and linkification. These issues are availability concerns. They do not allow script execution, data disclosure, or sanitizer bypass by themselves. Affected versions - justhtml 1.18.0...

justhtml introduces denial-of-service hardening

Summary justhtml 1.18.0 fixes multiple low-severity denial-of-service hardening issues in CSS selector handling and linkification. These issues are availability concerns. They do not allow script execution, data disclosure, or sanitizer bypass by themselves. Affected versions - justhtml 1.18.0...

PT-2026-41810

Summary justhtml 1.18.0 fixes multiple low-severity denial-of-service hardening issues in CSS selector handling and linkification. These issues are availability concerns. They do not allow script execution, data disclosure, or sanitizer bypass by themselves. Affected versions - justhtml 1.18.0...

PT-2026-79768

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.18.0 Description Multiple low-severity denial-of-service issues exist in CSS selector handling and linkification. Applications may consume disproportionate CPU or memory when evaluating attacker-controlled selector...

any2htpy (0.1.4) potentially affected by CVE-2026-6827 via justhtml (0.35.0)

justhtml PYPI version 0.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on justhtml and may be impacted: - any2htpy 0.1.4 Source cves: CVE-2026-6827 Source advisory: OSV:GHSA-VRX2-77F2-WW34...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by CVE-2026-6827 via justhtml (>=1.1.0, <=1.14.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: CVE-2026-6827 Source advisory: OSV:GHSA-VRX2-77F2-WW34...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.14.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: SNYK:PYTHON-JUSTHTML-16318347...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.14.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: GHSA-VRX2-77F2-WW34...

PT-2026-36663

Summary justhtml 1.17.0 fixes multiple security issues in sanitization, serialization, and programmatic DOM handling. Most of these issues affected advanced or custom configurations rather than the default safe path. Affected versions - justhtml , MathML , SVG / , and MathML text integration poin...

PT-2026-79772

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.17.0 Description Security issues exist in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces like SVG or MathML, dangerous content such as HTML integration...

Modification of Assumed-Immutable Data (MAID)

Overview justhtml is an A pure Python HTML5 parser that just works. Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data MAID through the sanitize, sanitizedom, and JustHTML..., sanitize=True paths in src/justhtml/sanitize.py. An attacker can bypass intended...

any2htpy (0.1.4) potentially affected by CVE-2026-7808 via justhtml (0.35.0)

justhtml PYPI version 0.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on justhtml and may be impacted: - any2htpy 0.1.4 Source cves: CVE-2026-7808 Source advisory: OSV:GHSA-4P64-V8F5-R2GX...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.14.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: GHSA-4P64-V8F5-R2GX...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by CVE-2026-7808 via justhtml (>=1.1.0, <=1.14.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: CVE-2026-7808 Source advisory: OSV:GHSA-4P64-V8F5-R2GX...