Showing 10 vulnerabilities on this page for justhtml

Signals CISA KEV Ransomware Nuclei
PyPI vulnerability results
VulnerabilityTitle and contextCVSSEPSSPoCsSignalsSTIX action

justhtml: to_markdown() code-span blank-line breakout enables XSS

# justhtml: to_markdown() code-span blank-line breakout enables XSS ### Summary In `justhtml` 0.9.0 through 1.21.0, `to_markdown()` renders `<code>` text (and `<pre>` text inside a link) as an inline Markdown code span whose only protection is backtick-fence length. A blank line (`\n\n`) in that text terminates the inline span in any compliant Markdown renderer, so attacker-controlled text that survived HTML sanitization is emitted **unescaped** after the blank line and is re-parsed as live ra

CWE-116CWE-79Jun 25, 2026
CVSS-v3.1EPSS-PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

justhtml introduces denial-of-service hardening

## Summary `justhtml` `1.18.0` fixes multiple low-severity denial-of-service hardening issues in CSS selector handling and linkification. These issues are availability concerns. They do not allow script execution, data disclosure, or sanitizer bypass by themselves. ## Affected versions - `justhtml` `< 1.18.0` ## Fixed version - `justhtml` `1.18.0` released on May 4, 2026 ## Impact ### CSS selector handling Applications that evaluate attacker-controlled selector strings, or that run sele

CVSS-EPSS-PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

justhtml has sanitization bypass in custom policies and programmatic DOM

## Summary `justhtml` `1.17.0` fixes multiple security issues in sanitization, serialization, and programmatic DOM handling. Most of these issues affected advanced or custom configurations rather than the default safe path. ## Affected versions - `justhtml` `<= 1.16.0` ## Fixed version - `justhtml` `1.17.0` released on April 19, 2026 ## Impact ### Custom SVG / MathML sanitization policies Custom policies that preserved foreign namespaces could allow dangerous content to survive sanitizat

CVSS-v4.0EPSS-PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Multiple security fixes in justhtml

## Summary `justhtml` `1.16.0` fixes multiple security issues in sanitization, serialization, and programmatic DOM handling. Most of these issues affected one of these advanced paths rather than ordinary parsed HTML with the default safe settings: - programmatic DOM input to `sanitize()` or `sanitize_dom()` - reused or mutated sanitization policy objects - custom policies that preserve foreign namespaces such as SVG or MathML ## Affected versions - `justhtml` `<= 1.15.0` ## Fixed version

CVSS-v4.0EPSS-PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

justhtml includes multiple security fixes

## Summary `justhtml` `1.15.0` includes multiple security fixes affecting URL sanitization helpers, HTML serialization, Markdown passthrough, and several custom sanitization-policy edge cases. These issues have different impact levels and do not all affect the default configuration in the same way. ## Affected versions - `justhtml` `<= 1.14.0` ## Fixed version - `justhtml` `1.15.0` released on April 9, 2026 ## Impact overview ### Helper and serialization issues These issues could affect

CVSS-EPSS-PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

justhtml: Mutation XSS with custom foreign-namespace sanitization policies

## Summary A parser-differential / mutation XSS issue was found in `justhtml` when using a **custom sanitization policy** that preserves foreign namespaces such as SVG or MathML. Under these custom settings, specially crafted input could sanitize into HTML that looked safe at first, but became unsafe when parsed again by a browser or another HTML parser. ## Impact This issue does **not** affect the default safe configuration. You may be affected if you use a custom `SanitizationPolicy` with

CWE-79Apr 8, 2026
CVSS-v4.0EPSS-PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

JustHTML is vulnerable to XSS via code fence breakout in <pre> content

## Summary `to_markdown()` is vulnerable when serializing attacker-controlled `<pre>` content. The `<pre>` handler emits a fixed three-backtick fenced code block, but writes decoded text content into that fence without choosing a delimiter longer than any backtick run inside the content. An attacker can place backticks and HTML-like text inside a sanitized `<pre>` element so that the generated Markdown closes the fence early and leaves raw HTML outside the code block. When that Markdown is ren

CWE-79CWE-80Mar 24, 2026
CVSS-v4.0EPSS-PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

JustHTML has a Sanitizer Bypass (in Markdown)

## Summary `to_markdown()` does not sufficiently escape text content that looks like HTML. As a result, untrusted input that is safe in `to_html()` can become raw HTML in Markdown output. This is not specific to tokenizer raw-text states like `<title>`, `<noscript>`, or `<plaintext>`, although those states can trigger the behavior. The root cause is broader: Markdown text serialization leaves angle brackets unescaped in text nodes. ## Details When converting a parsed document to Markdown, te

CWE-79Mar 18, 2026
CVSS-v4.0EPSS-PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

JustHTML Affected by Mutation XSS via Literal Text Serialization in Raw Text Elements (style/script)

## Summary Sanitized DOM trees can be unsafe to serialize when a custom policy allows raw-text elements such as `<style>` or `<script>`. The issue affects DOM trees that are constructed or modified programmatically and then passed through `sanitize_dom()` with a policy that keeps these elements. Text nodes inside `<style>` and `<script>` are serialized literally, so attacker-controlled text containing the matching closing tag sequence can break out of the raw-text context and inject HTML into

CWE-79Mar 18, 2026
CVSS-v4.0EPSS-PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Uncontrolled recursion DoS in JustHTML() via deeply nested HTML

### Summary justhtml through 1.9.1 allows denial of service via deeply nested HTML. During parsing, `JustHTML.__init__()` always reaches `TreeBuilder.finish()`, which unconditionally calls `_populate_selectedcontent()`. That function recursively traverses the DOM via `_find_elements()` / `_find_element()` without a depth bound, allowing attacker-controlled deeply nested input to trigger an unhandled `RecursionError` on CPython. Depending on the host application's exception handling, this can ab

CWE-674Mar 17, 2026
CVSS-v4.0EPSS-PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX