183 matches found
GHSA-5VP3-3CG6-2RQ3 JustHTML is vulnerable to XSS via code fence breakout in <pre> content
Summary tomarkdown is vulnerable when serializing attacker-controlled content. The handler emits a fixed three-backtick fenced code block, but writes decoded text content into that fence without choosing a delimiter longer than any backtick run inside the content. An attacker can place backticks...
PT-2026-30289
Summary to markdown is vulnerable when serializing attacker-controlled content. The handler emits a fixed three-backtick fenced code block, but writes decoded text content into that fence without choosing a delimiter longer than any backtick run inside the content. An attacker can place backticks...
Cross-site Scripting (XSS)
Overview justhtml is an A pure Python HTML5 parser that just works. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the tomarkdown function. An attacker can inject arbitrary HTML content by supplying specially crafted input that includes HTML-significant characters...
any2htpy (>=0.2.1, <=0.2.2) potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.2.0)
justhtml PYPI version =1.1.0, =0.2.1, =0.2.2 Source cves: unknown CVE Source advisory: GHSA-3RCM-VJRC-P45J...
any2htpy (>=0.2.1, <=0.2.2) potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.2.0)
justhtml PYPI version =1.1.0, =0.2.1, =0.2.2 Source cves: unknown CVE Source advisory: SNYK:PYTHON-JUSTHTML-15758896...
any2htpy (>=0.2.1, <=0.2.2) potentially affected by CVE-2026-8445 via justhtml (>=1.1.0, <=1.2.0)
justhtml PYPI version =1.1.0, =0.2.1, =0.2.2 Source cves: CVE-2026-8445 Source advisory: OSV:GHSA-3RCM-VJRC-P45J...
any2htpy (0.1.4) potentially affected by CVE-2026-8445 via justhtml (0.35.0)
justhtml PYPI version 0.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on justhtml and may be impacted: - any2htpy 0.1.4 Source cves: CVE-2026-8445 Source advisory: OSV:GHSA-3RCM-VJRC-P45J...
JustHTML has a Sanitizer Bypass (in Markdown)
Summary tomarkdown does not sufficiently escape text content that looks like HTML. As a result, untrusted input that is safe in tohtml can become raw HTML in Markdown output. This is not specific to tokenizer raw-text states like , , or , although those states can trigger the behavior. The root...
GHSA-3RCM-VJRC-P45J JustHTML has a Sanitizer Bypass (in Markdown)
Summary tomarkdown does not sufficiently escape text content that looks like HTML. As a result, untrusted input that is safe in tohtml can become raw HTML in Markdown output. This is not specific to tokenizer raw-text states like , , or , although those states can trigger the behavior. The root...
any2htpy (0.1.4) potentially affected by CVE-2026-8630 via justhtml (0.35.0)
justhtml PYPI version 0.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on justhtml and may be impacted: - any2htpy 0.1.4 Source cves: CVE-2026-8630 Source advisory: OSV:GHSA-QVC2-MG72-JJHX...
any2htpy (>=0.2.1, <=0.2.2) potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.2.0)
justhtml PYPI version =1.1.0, =0.2.1, =0.2.2 Source cves: unknown CVE Source advisory: GHSA-QVC2-MG72-JJHX...
any2htpy (>=0.2.1, <=0.2.2) potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.2.0)
justhtml PYPI version =1.1.0, =0.2.1, =0.2.2 Source cves: unknown CVE Source advisory: SNYK:PYTHON-JUSTHTML-15758897...
any2htpy (>=0.2.1, <=0.2.2) potentially affected by CVE-2026-8630 via justhtml (>=1.1.0, <=1.2.0)
justhtml PYPI version =1.1.0, =0.2.1, =0.2.2 Source cves: CVE-2026-8630 Source advisory: OSV:GHSA-QVC2-MG72-JJHX...
PT-2026-28763
Summary to markdown does not sufficiently escape text content that looks like HTML. As a result, untrusted input that is safe in to html can become raw HTML in Markdown output. This is not specific to tokenizer raw-text states like , , or , although those states can trigger the behavior. The root...
GHSA-V7CF-C9RM-WM3J Uncontrolled recursion DoS in JustHTML() via deeply nested HTML
Summary justhtml through 1.9.1 allows denial of service via deeply nested HTML. During parsing, JustHTML.init always reaches TreeBuilder.finish, which unconditionally calls populateselectedcontent. That function recursively traverses the DOM via findelements / findelement without a depth bound,...
Uncontrolled Recursion
Overview justhtml is an A pure Python HTML5 parser that just works. Affected versions of this package are vulnerable to Uncontrolled Recursion in the construction, when parsing deeply nested HTML structures. An attacker can cause the application to terminate unexpectedly or fail requests by...
any2htpy (0.1.4) potentially affected by CVE-2026-9769 via justhtml (0.35.0)
justhtml PYPI version 0.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on justhtml and may be impacted: - any2htpy 0.1.4 Source cves: CVE-2026-9769 Source advisory: OSV:GHSA-V7CF-C9RM-WM3J...
any2htpy (>=0.2.1, <=0.2.2) potentially affected by CVE-2026-9769 via justhtml (>=1.1.0, <=1.2.0)
justhtml PYPI version =1.1.0, =0.2.1, =0.2.2 Source cves: CVE-2026-9769 Source advisory: GHSA-V7CF-C9RM-WM3J...
any2htpy (>=0.2.1, <=0.2.2) potentially affected by CVE-2026-9769 via justhtml (>=1.1.0, <=1.2.0)
justhtml PYPI version =1.1.0, =0.2.1, =0.2.2 Source cves: CVE-2026-9769 Source advisory: OSV:GHSA-V7CF-C9RM-WM3J...