Executive brief
JustHTML, a Python library used for parsing and sanitizing HTML, contains several security vulnerabilities that could allow attackers to bypass safety filters. These flaws could lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user's browser, potentially compromising user data or sessions. Organizations using this library to process untrusted web content should update to the latest version to ensure their security protections remain effective.
Technical details
JustHTML 1.15.0 addresses multiple vulnerabilities including XSS (CWE-79), improper input validation (CWE-20), and case-sensitivity issues (CWE-178). Key flaws include the failure of 'clean_url_value' to block obfuscated 'javascript:' URIs, incorrect handling of backslashes in URLs allowing remote requests, and serialization errors where malformed programmatic node names or comments can inject live markup. Additionally, the 'to_markdown' helper with 'html_passthrough=True' could reintroduce active HTML from sanitized content. Attackers can exploit these by providing specially crafted HTML or URL strings that bypass sanitization logic. A patch is available in version 1.15.0.
Affected products
- EmilStenstrom justhtml <= 1.14.0
Timeline
- 2026-04-09: patched: Version 1.15.0 released
- 2026-04-10: advisory: GitHub Advisory GHSA-c9vm-hv86-f23r published