Executive brief
JustHTML is a Python HTML parsing library used to sanitize and process HTML content. An attacker can craft malicious HTML with deeply nested tags to trigger a crash during parsing. Depending on how an application handles exceptions, this could cause request failures, service interruption, or worker process termination—effectively a denial-of-service attack.
Technical details
The vulnerability is an uncontrolled recursion flaw (CWE-674) in the JustHTML DOM tree traversal functions. The root cause is in _find_elements() (and related functions like _node_to_html(), clone_node(deep=True), and _to_markdown_walk()), which recursively walk the DOM tree without enforcing a depth limit. When JustHTML.__init__() parses HTML, it unconditionally calls TreeBuilder.finish() → _populate_selectedcontent() → _find_elements(), which recursively traverses all nodes. On CPython with the default recursion limit of 1000, approximately 11 KB of nested <div> tags triggers RecursionError. No authentication or special privileges are required; any attacker who can supply HTML input (via web form, API, file upload, etc.) can trigger the error. The attack vector is network-based with low complexity. The library already demonstrates the correct pattern using iterative traversal in comparable functions, and a fix is available in version 1.10.0 by converting recursive implementations to iterative stack-based traversal.
Affected products
- Emil Stenstrom JustHTML <= 1.9.1
Timeline
- 2026-03-17: disclosed: Published to GitHub Advisory Database
- 2026-03-15: patched: Fixed in version 1.10.0