CVE-2026-4671
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings, run selector matching over very large untrusted documents, construct DOM trees from untrusted structure, or enable linkification over attacker-controlled text may consume disproportionate CPU or memory. These are availability-only concerns and do not allow script execution, data disclosure, or sanitizer bypass.
Risk Assessment
The organization may experience slowdowns or crashes if processing untrusted selectors or large documents. An attacker can exploit these issues to perform DoS attacks.
Recommendation
Update justhtml to version 1.18.0 or later. Limit trust in selectors and the size of processed documents.
Other vulnerabilities in justhtml
See all- CVE-2026-8445Critical
justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting to Markdown. Characters like < and > are preserved, allowing raw HTML injection into Markdown output, bypassing sanitization and potentially leading to XSS.
- CVE-2026-7808Critical
justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to XSS. The issues primarily affect advanced usage rather than the default JustHTML(..., sanitize=True) path.
- CVE-2026-5388Critical
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers, HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. An attacker can bypass sanitization to inject active HTML and JavaScript, e.g., via encoded javascript: URLs, backslash-based relative URLs, markup-breaking names, raw </textarea> reintroduction, or preserved <style>/<meta http-equiv=refresh>/<base href> tags.
- CVE-2026-9769High
justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() calls _populate_selectedcontent(), which recursively traverses the DOM tree without a depth bound. An attacker can supply deeply nested elements (e.g., ~1000 nested <div> tags) to exceed CPython's recursion limit and trigger an unhandled RecursionError.
- CVE-2026-8630Medium
justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation XSS (mXSS) vulnerability in the serialization of raw-text elements such as <style> and <script>. When a DOM tree is processed by sanitize_dom() with a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out and inject arbitrary HTML. The default sanitization policy is not affected because it drops the contents of style and script.
- CVE-2026-77088Medium
justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be emitted unescaped and re-parsed as live Markdown by compliant renderers.
- CVE-2026-74793Medium
justhtml before version 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling stored or reflected XSS attacks.
- CVE-2026-6827Medium
justhtml before version 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces (SVG/MathML), dangerous content such as HTML integration points (SVG <foreignObject>, MathML <annotation-xml encoding="text/html">) and mutation-XSS parser-differential payloads could survive sanitization and become active HTML after reparse; SVG filter="url(...)" and preserved <style> could leave resource-loading CSS (@import, background-image:url()). Programmatic script/style/Comment nodes could serialize into active markup. Additional hardening fixes address sanitize-pipeline cache mutation and DOM parent/child cycles that could cause infinite loops. Most issues affect advanced or custom configurations rather than the default JustHTML(..., sanitize=True) safe path.
- CVE-2026-5751Medium
justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vulnerability when using a custom SanitizationPolicy that preserves foreign namespaces (e.g., drop_foreign_namespaces=False with allowlisted SVG/MathML elements or raw-text containers such as <style>). Specially crafted input can sanitize into markup that appears safe but becomes unsafe when re-parsed by a browser or another HTML parser, allowing markup injection. The default safe configuration (sanitize=True) is not affected. Fixed in 1.14.0.
- CVE-2026-5389Medium
justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the generated Markdown is rendered by CommonMark or GFM-style renderers.
Original NVD description (English source)
justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings (via query(), matches(), or selector-based transforms), run selector matching over very large untrusted documents, construct DOM trees from untrusted structure, or enable linkification over attacker-controlled text may consume disproportionate CPU or memory. Triggers include oversized selectors, large selector lists, oversized compound selectors, long combinator chains, deeply nested functional pseudo-classes, repeated token/positional matching, cyclic DOM graphs causing non-terminating traversal, and punctuation-heavy or trailing-bracket linkification input. These are availability-only concerns and do not by themselves allow script execution, data disclosure, or sanitizer bypass. Default JustHTML(sanitize=True) usage is not expected to be exposed, since selectors are normally supplied by application code.