Vulnerability · Published Aug 23, 2026 · Assigned by VulnCheck
CVE-2026-7808justhtml before 1.16.0 Multiple Security Issues via Sanitization
Critical 9.8
In plain English
A critical-severity improper input validation in justhtml from EmilStenstrom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML(..., sanitize=True) path for ordinary parsed HTML: mutating or reusing sanitization policy objects (including exported defaults) could weaken later sanitization; programmatic DOM input to sanitize()/sanitize_dom() could miss mixed-case tag names (e.g., ScRiPt, StYlE); crafted programmatic doctype names could serialize into active markup; and custom policies preserving SVG or MathML could allow animation elements, presentation attributes with external url(...) references, or DOM trees mislabeled as namespace="html" to bypass foreign-content checks. Fixed in 1.16.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | justhtml | 1.16.0 | GHSA-4p64-v8f5-r2gx |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| EmilStenstrom | justhtml | 0 – before 1.16.0 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-4p64-v8f5-r2gx) vendor-advisory
- VulnCheck Advisory: justhtml before 1.16.0 Multiple Security Issues via Sanitization third-party-advisory