Is CVE-2026-4671 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4671 being exploited in the wild.

How severe is CVE-2026-4671?

High severity, with a CVSS score of 7.5, published 23 August 2026.

Which products and versions are affected?

justhtml (PyPI) ECOSYSTEM:introduced=0,fixed=1.18.0.

Is there a fix for CVE-2026-4671?

Yes. justhtml (PyPI): upgrade to 1.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4671 attacked?

It is attacked over the network.

Am I affected by CVE-2026-4671?

Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4671: justhtml denial-of-service in CSS selector handling and linkification

CVE-2026-4671 · Severity: high · CVSS 7.5 · Published 2026-08-23

justhtml is a Python library for parsing and sanitizing HTML documents. Versions before 1.18.0 contain multiple denial-of-service vulnerabilities where attackers can craft malicious CSS selectors or linkification input to consume excessive CPU or memory, potentially making applications unresponsive. While these issues do not allow unauthorized data access or code execution, they can disrupt service availability for applications that process untrusted selector strings or large documents.

Technologies: justhtml (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-4671 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4671 being exploited in the wild.
How severe is CVE-2026-4671?: High severity, with a CVSS score of 7.5, published 23 August 2026.
Which products and versions are affected?: justhtml (PyPI) ECOSYSTEM:introduced=0,fixed=1.18.0.
Is there a fix for CVE-2026-4671?: Yes. justhtml (PyPI): upgrade to 1.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4671 attacked?: It is attacked over the network.
Am I affected by CVE-2026-4671?: Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

justhtml (PyPI): upgrade to 1.18.0 or later
```
pip install "justhtml>=1.18.0"
```

Technical details

The vulnerability encompasses multiple denial-of-service issues in CSS selector parsing and matching, and in URL linkification logic. Attack vectors include oversized selectors, large selector lists, long combinator chains, deeply nested pseudo-classes like :not(), repeated token/attribute matching, cyclic DOM graphs, and punctuation-heavy linkification input. These triggers cause resource exhaustion through inefficient algorithmic complexity and uncontrolled resource consumption (CWE-400, CWE-407, CWE-835). Exploitation requires passing attacker-controlled selector strings to query(), matches(), or selector-based transforms, or enabling linkification on untrusted text. Default sanitization via JustHTML(sanitize=True) is not exposed because selectors are normally application-controlled. The patch in 1.18.0 introduces resource limits, structural caps, and removes repeated-work hot paths.

Affected products

EmilStenstrom justhtml before 1.18.0

Identifiers

CVE-2026-4671
GHSA-r8cj-3554-33mr

Timeline

2026-05-04: disclosed
2026-05-04: patched: Version 1.18.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.