any2htpy (>=0.2.1, <=0.2.2) potentially affected by CVE-2026-9769 via justhtml (>=1.1.0, <=1.2.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.2.2 Source cves: CVE-2026-9769 Source advisory: OSV:GHSA-V7CF-C9RM-WM3J...

any2htpy (>=0.2.1, <=0.2.2) potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.2.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.2.2 Source cves: unknown CVE Source advisory: SNYK:PYTHON-JUSTHTML-15758895...

PT-2026-28775

Summary justhtml through 1.9.1 allows denial of service via deeply nested HTML. During parsing, JustHTML. init always reaches TreeBuilder.finish, which unconditionally calls populate selectedcontent. That function recursively traverses the DOM via find elements / find element without a depth boun...

PT-2026-79778

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.10.0 Description Uncontrolled recursion occurs during the construction of JustHTML, where the TreeBuilder.finish function calls populate selectedcontent. This process recursively traverses the DOM tree using find...