Description

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings (via query(), matches(), or selector-based transforms), run selector matching over very large untrusted documents, construct DOM trees from untrusted structure, or enable linkification over attacker-controlled text may consume disproportionate CPU or memory. Triggers include oversized selectors, large selector lists, oversized compound selectors, long combinator chains, deeply nested functional pseudo-classes, repeated token/positional matching, cyclic DOM graphs causing non-terminating traversal, and punctuation-heavy or trailing-bracket linkification input. These are availability-only concerns and do not by themselves allow script execution, data disclosure, or sanitizer bypass. Default JustHTML(sanitize=True) usage is not expected to be exposed, since selectors are normally supplied by application code.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-23T14:16:53.293Z",
  "pubdate": "2026-08-23T14:16:53.293Z",
  "executiveSummary": "The justhtml package prior to version 1.18.0 contains multiple low-severity denial-of-service vulnerabilities residing within its CSS selector handling and linkification subsystems.\nThese availability-only concerns stem from inefficient processing of untrusted input, allowing malicious actors to induce resource exhaustion conditions characterized by disproportionate CPU or memory consumption.\nAffected systems include applications utilizing justhtml that evaluate attacker-controlled selector strings via functions such as query(), matches(), or selector-based transforms, execute selector matching against very large untrusted documents, construct DOM trees from untrusted structure, or enable linkification over attacker-controlled text.\nThe risk implications are strictly limited to service availability reduction, as the vulnerabilities do not by themselves permit arbitrary script execution, data disclosure, or bypass of sanitization mechanisms.\nAttacker capabilities are constrained to triggering computational bottlenecks or memory bloat, provided they can supply oversized or structurally complex inputs to vulnerable application code paths.\nDefault usage of JustHTML(sanitize=True) is typically not exposed to direct exploitation since selectors are normally supplied by application code rather than external users, meaning exploitation generally requires application-level exposure of selector evaluation or linkification features to untrusted input sources.",
  "technicalDetails": "The root cause of these denial-of-service vulnerabilities lies in algorithmic inefficiencies and unbounded parsing or traversal behaviors within the CSS selector handling and linkification logic of justhtml before version 1.18.0.\nThe vulnerable components include functions and methods responsible for CSS selector parsing, DOM tree traversal, selector matching, and text linkification.\nAffected versions comprise all releases of justhtml prior to 1.18.0.\nAuthentication requirements, privilege requirements, and network exposure depend entirely on the host application exposing the vulnerable interfaces, as the library itself operates as a programmatic dependency.\nSpecific triggers that initiate the resource exhaustion payload behavior include oversized selectors, large selector lists, oversized compound selectors, long combinator chains, deeply nested functional pseudo-classes, and repeated token or positional matching.\nAdditionally, cyclic DOM graphs can induce non-terminating traversal loops, while punctuation-heavy or trailing-bracket inputs can trigger expensive processing during linkification.\nThe attack flow proceeds as follows: First, an unauthenticated or privileged user provides maliciously crafted, highly complex, or oversized input to an application feature that passes the data directly into justhtml selector evaluation functions (such as query() or matches()), selector-based transformations, DOM tree construction routines, or linkification processors.\nSecond, upon receiving the payload, the vulnerable component attempts to parse, traverse, or match the input structure without adequate complexity bounds or recursion limits.\nThird, the resulting computational overhead or excessive memory allocation exhausts system resources.\nFinally, this leads to application latency, unresponsiveness, or outright denial of service.\nThe post-exploitation impact is strictly restricted to availability degradation, as the flaws lack the capability to achieve code execution, memory disclosure, or security control bypass."
}