CVE-2026-5389

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the tomarkdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...

CVE-2026-5388

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

EUVD-2026-64652

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

any2htpy (>=0.1.4, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by CVE-2026-5388 via justhtml (>=0.35.0, <=1.14.0)

justhtml PYPI version =0.35.0, =0.1.4, =0.5.8, =0.1.0, =0.1.5 Source cves: CVE-2026-5388 Source advisory: MEND:CVE-2026-5388...

CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-5388

justhtml (Python HTML sanitizer library) before 1.15.0 contains multiple sanitization bypass vulnerabilities across URL sanitization helpers, HTML serialization, Markdown passthrough, and custom policy edge cases. Attackers can inject active HTML and JavaScript via vectors such as encoded javascr...

CVE-2026-4671

justhtml (Python HTML sanitizer library) versions before 1.18.0 contain multiple denial-of-service vulnerabilities in CSS selector handling and linkification . Attacker-controlled selector strings passed to query(), matches(), or selector-based transforms, or linkification over untrusted text, ca...

CVE-2026-4671 justhtml before 1.18.0 Denial of Service via CSS Selector

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings via query, matches, or selector-based transforms, run selector matching over very large untrusted documents,...

CVE-2026-4671

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings via query, matches, or selector-based transforms, run selector matching over very large untrusted documents,...

CVE-2026-4671 justhtml before 1.18.0 Denial of Service via CSS Selector

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings via query, matches, or selector-based transforms, run selector matching over very large untrusted documents,...

any2htpy (>=0.1.4, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by CVE-2026-4671 via justhtml (>=0.35.0, <=1.14.0)

justhtml PYPI version =0.35.0, =0.1.4, =0.5.8, =0.1.0, =0.1.5 Source cves: CVE-2026-4671 Source advisory: MEND:CVE-2026-4671...

EUVD-2026-64651

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings via query, matches, or selector-based transforms, run selector matching over very large untrusted documents,...

CVE-2026-4671 justhtml before 1.18.0 Denial of Service via CSS Selector

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings via query, matches, or selector-based transforms, run selector matching over very large untrusted documents,...

CVE-2026-9769: Uncontrolled Recursion

justhtml through 1.9.1 fixed in 1.10.0 is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML construction, TreeBuilder.finish unconditionally calls populateselectedcontent, which recursively traverses the DOM tree via findelements/findelement without a depth bound...

CVE-2026-8445: Improper Neutralization of Input During Web Page Generation

justhtml versions are preserved, so untrusted input that is safe in tohtml — including entity-decoded text e.g. or text from RCDATA/RAWTEXT-parsed elements like , , , and — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting when that...

CVE-2026-8630: Improper Neutralization of Input During Web Page Generation

justhtml before 1.12.0 versions = 1.11.0 contains a mutation cross-site scripting mXSS vulnerability in the serialization of raw-text elements such as...

CVE-2026-7808: Improper Input Validation

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...

PT-2026-79776

justhtml versions are preserved, so untrusted input that is safe in to html — including entity-decoded text e.g. script or text from RCDATA/RAWTEXT-parsed elements like , , , and — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting wh...

PT-2026-79771

justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting mXSS vulnerability when using a custom SanitizationPolicy that preserves foreign namespaces e.g., drop foreign namespaces=False with allowlisted SVG/MathML elements or raw-text containers such as...