Executive brief
justhtml is a Python library for parsing and sanitizing HTML documents. Versions before 1.18.0 contain multiple denial-of-service vulnerabilities where attackers can craft malicious CSS selectors or linkification input to consume excessive CPU or memory, potentially making applications unresponsive. While these issues do not allow unauthorized data access or code execution, they can disrupt service availability for applications that process untrusted selector strings or large documents.
Technical details
The vulnerability encompasses multiple denial-of-service issues in CSS selector parsing and matching, and in URL linkification logic. Attack vectors include oversized selectors, large selector lists, long combinator chains, deeply nested pseudo-classes like :not(), repeated token/attribute matching, cyclic DOM graphs, and punctuation-heavy linkification input. These triggers cause resource exhaustion through inefficient algorithmic complexity and uncontrolled resource consumption (CWE-400, CWE-407, CWE-835). Exploitation requires passing attacker-controlled selector strings to query(), matches(), or selector-based transforms, or enabling linkification on untrusted text. Default sanitization via JustHTML(sanitize=True) is not exposed because selectors are normally application-controlled. The patch in 1.18.0 introduces resource limits, structural caps, and removes repeated-work hot paths.
Affected products
- EmilStenstrom justhtml before 1.18.0
Timeline
- 2026-05-04: disclosed
- 2026-05-04: patched: Version 1.18.0 released