Is CVE-2026-5388 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5388 being exploited in the wild.

How severe is CVE-2026-5388?

Critical severity, with a CVSS score of 9.8, published 23 August 2026.

Which products and versions are affected?

justhtml (PyPI) ECOSYSTEM:introduced=0,fixed=1.15.0.

Is there a fix for CVE-2026-5388?

Yes. justhtml (PyPI): upgrade to 1.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5388 attacked?

It is attacked over the network.

Am I affected by CVE-2026-5388?

Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5388: justhtml multiple security issues in URL sanitization and HTML serialization

CVE-2026-5388 · Severity: critical · CVSS 9.8 · Published 2026-08-23

justhtml is a Python library for sanitizing HTML and preventing malicious script injection. Versions before 1.15.0 contain multiple flaws that allow attackers to bypass sanitization protections and inject active JavaScript or malicious HTML content. Depending on how the library is configured, attackers could execute arbitrary code in users' browsers, steal sensitive data, or redirect users to malicious sites. The issues particularly affect custom security policies, helper functions, and Markdown passthrough features.

Technologies: justhtml (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-5388 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5388 being exploited in the wild.
How severe is CVE-2026-5388?: Critical severity, with a CVSS score of 9.8, published 23 August 2026.
Which products and versions are affected?: justhtml (PyPI) ECOSYSTEM:introduced=0,fixed=1.15.0.
Is there a fix for CVE-2026-5388?: Yes. justhtml (PyPI): upgrade to 1.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5388 attacked?: It is attacked over the network.
Am I affected by CVE-2026-5388?: Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

justhtml (PyPI): upgrade to 1.15.0 or later
```
pip install "justhtml>=1.15.0"
```

Technical details

justhtml 1.14.0 and earlier contain multiple input validation and XSS-related flaws across several components. The clean_url_value() and clean_url_in_js_string() helper functions incorrectly accept encoded javascript: URLs (e.g., javascript:) that become active after HTML parsing, and backslash-based relative URLs (e.g., \evil.example/x) that browsers resolve as remote requests. URL sanitization can crash when processing malformed bracketed hosts in allowlists. Programmatic DOM construction can serialize element/attribute names with markup-breaking characters, breaking out of intended tags. The html_passthrough=True mode can reintroduce raw </textarea> sequences. Custom policies may preserve <style>, <meta http-equiv="refresh">, <base href>, and space-separated URL attributes (ping, attributionsrc, imagesrcset) without proper URL validation. Case-sensitivity issues in custom transform pipelines can bypass security transforms. The default sanitize=True configuration is largely unaffected except for helper APIs and programmatic usage. Patches are available in version 1.15.0 released April 9, 2026.

Affected products

justhtml justhtml before 1.15.0

Identifiers

CVE-2026-5388
GHSA-c9vm-hv86-f23r

Timeline

2026-04-09: disclosed: Advisory published; version 1.15.0 released with fixes
2026-08-23: other: CVE-2026-5388 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.