{"schema_version":1,"title":"justhtml (PyPI) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 16 vulnerabilities in justhtml (PyPI): 0 in the last 7 days and 12 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, justhtml uncontrolled recursion DoS via deeply nested HTML, was published on 23 August 2026.","url":"https://junglewise.ai/threats/technologies/justhtml","json_url":"https://junglewise.ai/threats/technologies/justhtml.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/justhtml","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":3,"all_time":16,"critical":3,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":12,"last_365_days":16},"latest":[{"cvss":7.5,"slug":"justhtml-uncontrolled-recursion-dos-via-deeply-nested-html-26591bb6","title":"justhtml uncontrolled recursion DoS via deeply nested HTML","severity":"high","exploited":false,"published_at":"2026-08-23T15:33:06+00:00","url":"https://junglewise.ai/threats/justhtml-uncontrolled-recursion-dos-via-deeply-nested-html-26591bb6"},{"cve":"CVE-2026-9769","cvss":7.5,"epss":0.0049,"slug":"cve-2026-9769-justhtml-uncontrolled-recursion-dos-via-deeply-nested-html","title":"justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() constructio","severity":"high","exploited":false,"published_at":"2026-08-23T14:16:55.277+00:00","url":"https://junglewise.ai/threats/cve-2026-9769-justhtml-uncontrolled-recursion-dos-via-deeply-nested-html"},{"cve":"CVE-2026-8630","cvss":6.1,"epss":0.0026,"slug":"cve-2026-8630-justhtml-mutation-xss-in-raw-text-element-serialization","title":"justhtml mutation XSS in raw-text element serialization","severity":"medium","exploited":false,"published_at":"2026-08-23T14:16:55.127+00:00","url":"https://junglewise.ai/threats/cve-2026-8630-justhtml-mutation-xss-in-raw-text-element-serialization"},{"cve":"CVE-2026-8445","cvss":9.8,"epss":0.0064,"slug":"cve-2026-8445-justhtml-html-escaping-bypass-in-markdown-conversion","title":"justhtml HTML escaping bypass in Markdown conversion","severity":"critical","exploited":false,"published_at":"2026-08-23T14:16:54.957+00:00","url":"https://junglewise.ai/threats/cve-2026-8445-justhtml-html-escaping-bypass-in-markdown-conversion"},{"cve":"CVE-2026-7808","cvss":9.8,"epss":0.0059,"slug":"cve-2026-7808-justhtml-html-sanitization-bypass-leading-to-xss","title":"justhtml HTML sanitization bypass leading to XSS","severity":"critical","exploited":false,"published_at":"2026-08-23T14:16:54.81+00:00","url":"https://junglewise.ai/threats/cve-2026-7808-justhtml-html-sanitization-bypass-leading-to-xss"},{"cve":"CVE-2026-77088","cvss":6.1,"epss":0.0026,"slug":"cve-2026-77088-justhtml-to-markdown-cross-site-scripting-in-code-span","title":"justhtml to_markdown() cross-site scripting in code span","severity":"medium","exploited":false,"published_at":"2026-08-23T14:16:54.433+00:00","url":"https://junglewise.ai/threats/cve-2026-77088-justhtml-to-markdown-cross-site-scripting-in-code-span"},{"cve":"CVE-2026-74793","cvss":6.1,"epss":0.0029,"slug":"cve-2026-74793-justhtml-cross-site-scripting-in-selectedcontent-projection","title":"justhtml cross-site scripting in selectedcontent projection","severity":"medium","exploited":false,"published_at":"2026-08-23T14:16:54.127+00:00","url":"https://junglewise.ai/threats/cve-2026-74793-justhtml-cross-site-scripting-in-selectedcontent-projection"},{"cve":"CVE-2026-6827","cvss":6.1,"epss":0.0026,"slug":"cve-2026-6827-justhtml-multiple-sanitization-and-dom-handling-vulnerabilities","title":"justhtml multiple sanitization and DOM handling vulnerabilities","severity":"medium","exploited":false,"published_at":"2026-08-23T14:16:53.963+00:00","url":"https://junglewise.ai/threats/cve-2026-6827-justhtml-multiple-sanitization-and-dom-handling-vulnerabilities"},{"cve":"CVE-2026-5751","cvss":6.1,"epss":0.0026,"slug":"cve-2026-5751-justhtml-mutation-cross-site-scripting-in-custom-sanitization","title":"justhtml mutation cross-site scripting in custom sanitization policies","severity":"medium","exploited":false,"published_at":"2026-08-23T14:16:53.807+00:00","url":"https://junglewise.ai/threats/cve-2026-5751-justhtml-mutation-cross-site-scripting-in-custom-sanitization"},{"cve":"CVE-2026-5389","cvss":6.1,"epss":0.0026,"slug":"cve-2026-5389-justhtml-to-markdown-cross-site-scripting-via-code-fence-breakout","title":"justhtml to_markdown() cross-site scripting via code fence breakout","severity":"medium","exploited":false,"published_at":"2026-08-23T14:16:53.647+00:00","url":"https://junglewise.ai/threats/cve-2026-5389-justhtml-to-markdown-cross-site-scripting-via-code-fence-breakout"},{"cve":"CVE-2026-5388","cvss":9.8,"epss":0.0059,"slug":"cve-2026-5388-justhtml-multiple-security-issues-in-url-sanitization-and-html","title":"justhtml multiple security issues in URL sanitization and HTML serialization","severity":"critical","exploited":false,"published_at":"2026-08-23T14:16:53.47+00:00","url":"https://junglewise.ai/threats/cve-2026-5388-justhtml-multiple-security-issues-in-url-sanitization-and-html"},{"cve":"CVE-2026-4671","cvss":7.5,"epss":0.0065,"slug":"cve-2026-4671-justhtml-denial-of-service-in-css-selector-handling-and","title":"justhtml denial-of-service in CSS selector handling and linkification","severity":"high","exploited":false,"published_at":"2026-08-23T14:16:53.293+00:00","url":"https://junglewise.ai/threats/cve-2026-4671-justhtml-denial-of-service-in-css-selector-handling-and"},{"cvss":6.1,"slug":"emilstenstrom-justhtml-xss-in-to-markdown-via-code-span-breakout-8bdc7479","title":"EmilStenstrom justhtml XSS in to_markdown via code-span breakout","severity":"medium","exploited":false,"published_at":"2026-06-25T17:35:52+00:00","url":"https://junglewise.ai/threats/emilstenstrom-justhtml-xss-in-to-markdown-via-code-span-breakout-8bdc7479"},{"slug":"justhtml-has-sanitization-bypass-in-custom-policies-and-programmatic-9618831f","title":"justhtml has sanitization bypass in custom policies and programmatic DOM","severity":"medium","exploited":false,"published_at":"2026-04-22T21:25:46+00:00","url":"https://junglewise.ai/threats/justhtml-has-sanitization-bypass-in-custom-policies-and-programmatic-9618831f"},{"cvss":1.3,"slug":"emilstenstrom-justhtml-multiple-sanitization-bypasses-c3dbbb24","title":"EmilStenstrom justhtml multiple sanitization bypasses","severity":"low","exploited":false,"published_at":"2026-04-14T20:05:10+00:00","url":"https://junglewise.ai/threats/emilstenstrom-justhtml-multiple-sanitization-bypasses-c3dbbb24"},{"cvss":6.1,"slug":"emilstenstrom-justhtml-multiple-xss-and-sanitization-bypasses-f2abebf1","title":"EmilStenstrom justhtml multiple XSS and sanitization bypasses","severity":"medium","exploited":false,"published_at":"2026-04-10T19:20:04+00:00","url":"https://junglewise.ai/threats/emilstenstrom-justhtml-multiple-xss-and-sanitization-bypasses-f2abebf1"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":3,"exploited":0,"vulnerabilities":12},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"tensorflow (PyPI)","slug":"pypi-tensorflow","vulnerabilities":428,"url":"https://junglewise.ai/threats/technologies/pypi-tensorflow"},{"name":"tensorflow-cpu (PyPI)","slug":"tensorflow-cpu","vulnerabilities":424,"url":"https://junglewise.ai/threats/technologies/tensorflow-cpu"},{"name":"tensorflow-gpu (PyPI)","slug":"tensorflow-gpu","vulnerabilities":421,"url":"https://junglewise.ai/threats/technologies/tensorflow-gpu"},{"name":"open-webui (PyPI)","slug":"open-webui","vulnerabilities":177,"url":"https://junglewise.ai/threats/technologies/open-webui"},{"name":"Django (PyPI)","slug":"django","vulnerabilities":172,"url":"https://junglewise.ai/threats/technologies/django"},{"name":"apache-airflow (PyPI)","slug":"apache-airflow","vulnerabilities":152,"url":"https://junglewise.ai/threats/technologies/apache-airflow"},{"name":"plone (PyPI)","slug":"pypi-plone","vulnerabilities":101,"url":"https://junglewise.ai/threats/technologies/pypi-plone"},{"name":"praisonai (PyPI)","slug":"pypi-praisonai","vulnerabilities":86,"url":"https://junglewise.ai/threats/technologies/pypi-praisonai"},{"name":"exiv2 (PyPI)","slug":"exiv2","vulnerabilities":85,"url":"https://junglewise.ai/threats/technologies/exiv2"},{"name":"nltk (PyPI)","slug":"nltk","vulnerabilities":83,"url":"https://junglewise.ai/threats/technologies/nltk"},{"name":"mlflow (PyPI)","slug":"mlflow","vulnerabilities":82,"url":"https://junglewise.ai/threats/technologies/mlflow"},{"name":"pillow (PyPI)","slug":"pillow","vulnerabilities":79,"url":"https://junglewise.ai/threats/technologies/pillow"}],"technology":{"hub":true,"name":"justhtml (PyPI)","slug":"justhtml","vendor":{"name":"PyPI","slug":"pypi","url":"https://junglewise.ai/threats/vendors/pypi"},"aliases":[],"homepage":"https://pypi.org/project/justhtml/","repo_url":"https://github.com/justhtml/justhtml","description":"A Python library for generating HTML documents using Pythonic syntax.","url":"https://junglewise.ai/threats/technologies/justhtml"},"most_severe":[{"cve":"CVE-2026-8445","cvss":9.8,"epss":0.0064,"slug":"cve-2026-8445-justhtml-html-escaping-bypass-in-markdown-conversion","title":"justhtml HTML escaping bypass in Markdown conversion","severity":"critical","exploited":false,"published_at":"2026-08-23T14:16:54.957+00:00","url":"https://junglewise.ai/threats/cve-2026-8445-justhtml-html-escaping-bypass-in-markdown-conversion"},{"cve":"CVE-2026-7808","cvss":9.8,"epss":0.0059,"slug":"cve-2026-7808-justhtml-html-sanitization-bypass-leading-to-xss","title":"justhtml HTML sanitization bypass leading to XSS","severity":"critical","exploited":false,"published_at":"2026-08-23T14:16:54.81+00:00","url":"https://junglewise.ai/threats/cve-2026-7808-justhtml-html-sanitization-bypass-leading-to-xss"},{"cve":"CVE-2026-5388","cvss":9.8,"epss":0.0059,"slug":"cve-2026-5388-justhtml-multiple-security-issues-in-url-sanitization-and-html","title":"justhtml multiple security issues in URL sanitization and HTML serialization","severity":"critical","exploited":false,"published_at":"2026-08-23T14:16:53.47+00:00","url":"https://junglewise.ai/threats/cve-2026-5388-justhtml-multiple-security-issues-in-url-sanitization-and-html"},{"cve":"CVE-2026-4671","cvss":7.5,"epss":0.0065,"slug":"cve-2026-4671-justhtml-denial-of-service-in-css-selector-handling-and","title":"justhtml denial-of-service in CSS selector handling and linkification","severity":"high","exploited":false,"published_at":"2026-08-23T14:16:53.293+00:00","url":"https://junglewise.ai/threats/cve-2026-4671-justhtml-denial-of-service-in-css-selector-handling-and"},{"cve":"CVE-2026-9769","cvss":7.5,"epss":0.0049,"slug":"cve-2026-9769-justhtml-uncontrolled-recursion-dos-via-deeply-nested-html","title":"justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() constructio","severity":"high","exploited":false,"published_at":"2026-08-23T14:16:55.277+00:00","url":"https://junglewise.ai/threats/cve-2026-9769-justhtml-uncontrolled-recursion-dos-via-deeply-nested-html"},{"cvss":7.5,"slug":"justhtml-uncontrolled-recursion-dos-via-deeply-nested-html-26591bb6","title":"justhtml uncontrolled recursion DoS via deeply nested HTML","severity":"high","exploited":false,"published_at":"2026-08-23T15:33:06+00:00","url":"https://junglewise.ai/threats/justhtml-uncontrolled-recursion-dos-via-deeply-nested-html-26591bb6"},{"cve":"CVE-2026-74793","cvss":6.1,"epss":0.0029,"slug":"cve-2026-74793-justhtml-cross-site-scripting-in-selectedcontent-projection","title":"justhtml cross-site scripting in selectedcontent projection","severity":"medium","exploited":false,"published_at":"2026-08-23T14:16:54.127+00:00","url":"https://junglewise.ai/threats/cve-2026-74793-justhtml-cross-site-scripting-in-selectedcontent-projection"},{"cve":"CVE-2026-8630","cvss":6.1,"epss":0.0026,"slug":"cve-2026-8630-justhtml-mutation-xss-in-raw-text-element-serialization","title":"justhtml mutation XSS in raw-text element serialization","severity":"medium","exploited":false,"published_at":"2026-08-23T14:16:55.127+00:00","url":"https://junglewise.ai/threats/cve-2026-8630-justhtml-mutation-xss-in-raw-text-element-serialization"},{"cve":"CVE-2026-77088","cvss":6.1,"epss":0.0026,"slug":"cve-2026-77088-justhtml-to-markdown-cross-site-scripting-in-code-span","title":"justhtml to_markdown() cross-site scripting in code span","severity":"medium","exploited":false,"published_at":"2026-08-23T14:16:54.433+00:00","url":"https://junglewise.ai/threats/cve-2026-77088-justhtml-to-markdown-cross-site-scripting-in-code-span"},{"cve":"CVE-2026-6827","cvss":6.1,"epss":0.0026,"slug":"cve-2026-6827-justhtml-multiple-sanitization-and-dom-handling-vulnerabilities","title":"justhtml multiple sanitization and DOM handling vulnerabilities","severity":"medium","exploited":false,"published_at":"2026-08-23T14:16:53.963+00:00","url":"https://junglewise.ai/threats/cve-2026-6827-justhtml-multiple-sanitization-and-dom-handling-vulnerabilities"}],"generated_at":"2026-09-27T03:07:00.185062+00:00"}