Executive brief
justhtml is a Python library for sanitizing HTML and preventing malicious script injection. Versions before 1.15.0 contain multiple flaws that allow attackers to bypass sanitization protections and inject active JavaScript or malicious HTML content. Depending on how the library is configured, attackers could execute arbitrary code in users' browsers, steal sensitive data, or redirect users to malicious sites. The issues particularly affect custom security policies, helper functions, and Markdown passthrough features.
Technical details
justhtml 1.14.0 and earlier contain multiple input validation and XSS-related flaws across several components. The clean_url_value() and clean_url_in_js_string() helper functions incorrectly accept encoded javascript: URLs (e.g., javascript:) that become active after HTML parsing, and backslash-based relative URLs (e.g., \evil.example/x) that browsers resolve as remote requests. URL sanitization can crash when processing malformed bracketed hosts in allowlists. Programmatic DOM construction can serialize element/attribute names with markup-breaking characters, breaking out of intended tags. The html_passthrough=True mode can reintroduce raw </textarea> sequences. Custom policies may preserve <style>, <meta http-equiv="refresh">, <base href>, and space-separated URL attributes (ping, attributionsrc, imagesrcset) without proper URL validation. Case-sensitivity issues in custom transform pipelines can bypass security transforms. The default sanitize=True configuration is largely unaffected except for helper APIs and programmatic usage. Patches are available in version 1.15.0 released April 9, 2026.
Affected products
- justhtml justhtml before 1.15.0
Timeline
- 2026-04-09: disclosed: Advisory published; version 1.15.0 released with fixes
- 2026-08-23: other: CVE-2026-5388 assigned