Description

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-23T14:16:53.470Z",
  "pubdate": "2026-08-23T14:16:53.470Z",
  "executiveSummary": "The justhtml package prior to version 1.15.0 contains multiple security vulnerabilities involving URL sanitization helpers, HTML serialization, Markdown passthrough, and custom sanitization-policy edge cases.\nThese flaws allow an authenticated or unauthenticated attacker to bypass established input sanitization mechanisms, leading to the injection of active HTML and malicious JavaScript into the rendered output.\nThe affected components include the URL sanitization helpers clean_url_value and clean_url_in_js_string, HTML serialization routines, Markdown passthrough features where html_passthrough=True is enabled, and custom sanitization-policy configurations.\nWhile the default sanitize=True configuration mitigates most standard risks, custom policies, programmatic DOM construction, transform pipelines, and helper APIs remain susceptible.\nSuccessful exploitation enables potential Cross-Site Scripting (XSS) and arbitrary script execution within the context of a victim user's browser session, depending on the specific application configuration and integration context.",
  "technicalDetails": "The vulnerabilities stem from insufficient validation and flawed parsing logic across multiple sanitization helpers, serialization routines, and policy handlers within justhtml before version 1.15.0.\nAttackers can leverage several distinct attack vectors to bypass sanitization depending on the active configuration: encoded javascript: URLs, backslash-based relative URLs that resolve to remote hosts, markup-breaking programmatic element or attribute names, and maliciously crafted HTML comments.\nIn configurations utilizing Markdown passthrough with html_passthrough=True, raw closing tags such as </textarea> can be reintroduced to break out of context blocks and inject arbitrary markup.\nFurthermore, custom sanitization policies may incorrectly preserve sensitive tags like <style>, <meta http-equiv=refresh>, and <base href> tags.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious payload utilizing one of the supported bypass vectors, such as an encoded javascript: URL or a backslash-resolved remote URL, targeting vulnerable helper functions like clean_url_value or clean_url_in_js_string.\nSecond, the payload is submitted to the application endpoint utilizing programmatic DOM construction, custom sanitization pipelines, or Markdown passthrough modes.\nThird, because the underlying validation logic fails to adequately sanitize or normalize the input, the malicious payload passes through the parser without being neutralized.\nFinally, when the application serializes the HTML or renders the input, the injected active HTML or JavaScript executes in the context of the user's browser session, resulting in security compromise."
}