Vulnerability · Published Aug 23, 2026 · Assigned by VulnCheck

CVE-2026-5388justhtml before 1.15.0 Multiple Security Issues

Critical 9.8

In plain English

A critical-severity improper input validation in justhtml from EmilStenstrom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.6%top 51.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	justhtml	1.15.0	GHSA-c9vm-hv86-f23r

Affected products (as reported)

Vendor	Product	Versions
EmilStenstrom	justhtml	0 – before 1.15.0

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-c9vm-hv86-f23r) vendor-advisory
VulnCheck Advisory: justhtml before 1.15.0 Multiple Security Issues third-party-advisory