183 matches found
GHSA-4P64-V8F5-R2GX Multiple security fixes in justhtml
Summary justhtml 1.16.0 fixes multiple security issues in sanitization, serialization, and programmatic DOM handling. Most of these issues affected one of these advanced paths rather than ordinary parsed HTML with the default safe settings: - programmatic DOM input to sanitize or sanitizedom -...
PT-2026-35096
Summary justhtml 1.16.0 fixes multiple security issues in sanitization, serialization, and programmatic DOM handling. Most of these issues affected one of these advanced paths rather than ordinary parsed HTML with the default safe settings: - programmatic DOM input to sanitize or sanitize dom -...
any2htpy (0.1.4) potentially affected by CVE-2026-5388 via justhtml (0.35.0)
justhtml PYPI version 0.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on justhtml and may be impacted: - any2htpy 0.1.4 Source cves: CVE-2026-5388 Source advisory: OSV:GHSA-C9VM-HV86-F23R...
any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.14.0)
justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: GHSA-C9VM-HV86-F23R...
any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.14.0)
justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: SNYK:PYTHON-JUSTHTML-16032358...
any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by CVE-2026-5388 via justhtml (>=1.1.0, <=1.14.0)
justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: CVE-2026-5388 Source advisory: OSV:GHSA-C9VM-HV86-F23R...
Cross-site Scripting (XSS)
Overview justhtml is an A pure Python HTML5 parser that just works. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the handling of URL sanitization helpers, HTML serialization, Markdown passthrough, and custom sanitization-policy edge cases. An attacker can execut...
PT-2026-33893
Summary justhtml 1.15.0 includes multiple security fixes affecting URL sanitization helpers, HTML serialization, Markdown passthrough, and several custom sanitization-policy edge cases. These issues have different impact levels and do not all affect the default configuration in the same way...
article-extractor (>=0.5.8, <=0.5.9) potentially affected by CVE-2026-5751 via justhtml (1.13.0)
justhtml PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on justhtml and may be impacted: - article-extractor =0.5.8, =0.5.9 Source cves: CVE-2026-5751 Source advisory: OSV:GHSA-R758-8HXW-4845...
article-extractor (>=0.5.8, <=0.5.9) potentially affected by unknown CVE via justhtml (1.13.0)
justhtml PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on justhtml and may be impacted: - article-extractor =0.5.8, =0.5.9 Source cves: unknown CVE Source advisory: GHSA-R758-8HXW-4845...
any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.13.0)
justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.5.9 Source cves: unknown CVE Source advisory: SNYK:PYTHON-JUSTHTML-15928878...
justhtml: Mutation XSS with custom foreign-namespace sanitization policies
Summary A parser-differential / mutation XSS issue was found in justhtml when using a custom sanitization policy that preserves foreign namespaces such as SVG or MathML. Under these custom settings, specially crafted input could sanitize into HTML that looked safe at first, but became unsafe when...
GHSA-R758-8HXW-4845 justhtml: Mutation XSS with custom foreign-namespace sanitization policies
Summary A parser-differential / mutation XSS issue was found in justhtml when using a custom sanitization policy that preserves foreign namespaces such as SVG or MathML. Under these custom settings, specially crafted input could sanitize into HTML that looked safe at first, but became unsafe when...
Cross-site Scripting (XSS)
Overview justhtml is an A pure Python HTML5 parser that just works. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the custom SanitizationPolicy if configured with dropforeignnamespaces=False or allowlisted foreign elements such as MathML or SVG or raw-text...
PT-2026-33573
Summary A parser-differential / mutation XSS issue was found in justhtml when using a custom sanitization policy that preserves foreign namespaces such as SVG or MathML. Under these custom settings, specially crafted input could sanitize into HTML that looked safe at first, but became unsafe when...
any2htpy (>=0.2.1, <=0.2.2) potentially affected by CVE-2026-5389 via justhtml (>=1.1.0, <=1.2.0)
justhtml PYPI version =1.1.0, =0.2.1, =0.2.2 Source cves: CVE-2026-5389 Source advisory: OSV:GHSA-5VP3-3CG6-2RQ3...
any2htpy (>=0.2.1, <=0.2.2) potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.2.0)
justhtml PYPI version =1.1.0, =0.2.1, =0.2.2 Source cves: unknown CVE Source advisory: SNYK:PYTHON-JUSTHTML-15763557...
any2htpy (0.1.4) potentially affected by CVE-2026-5389 via justhtml (0.35.0)
justhtml PYPI version 0.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on justhtml and may be impacted: - any2htpy 0.1.4 Source cves: CVE-2026-5389 Source advisory: OSV:GHSA-5VP3-3CG6-2RQ3...
any2htpy (>=0.2.1, <=0.2.2) potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.2.0)
justhtml PYPI version =1.1.0, =0.2.1, =0.2.2 Source cves: unknown CVE Source advisory: GHSA-5VP3-3CG6-2RQ3...
JustHTML is vulnerable to XSS via code fence breakout in <pre> content
Summary tomarkdown is vulnerable when serializing attacker-controlled content. The handler emits a fixed three-backtick fenced code block, but writes decoded text content into that fence without choosing a delimiter longer than any backtick run inside the content. An attacker can place backticks...