Vulnerability · Published Aug 23, 2026 · Assigned by VulnCheck
CVE-2026-4671justhtml before 1.18.0 Denial of Service via CSS Selector
High 7.5
In plain English
A high-severity uncontrolled resource consumption in justhtml from EmilStenstrom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings (via query(), matches(), or selector-based transforms), run selector matching over very large untrusted documents, construct DOM trees from untrusted structure, or enable linkification over attacker-controlled text may consume disproportionate CPU or memory. Triggers include oversized selectors, large selector lists, oversized compound selectors, long combinator chains, deeply nested functional pseudo-classes, repeated token/positional matching, cyclic DOM graphs causing non-terminating traversal, and punctuation-heavy or trailing-bracket linkification input. These are availability-only concerns and do not by themselves allow script execution, data disclosure, or sanitizer bypass. Default JustHTML(sanitize=True) usage is not expected to be exposed, since selectors are normally supplied by application code.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | justhtml | 1.18.0 | GHSA-r8cj-3554-33mr |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| EmilStenstrom | justhtml | 0 – before 1.18.0 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-r8cj-3554-33mr) vendor-advisory
- VulnCheck Advisory: justhtml before 1.18.0 Denial of Service via CSS Selector third-party-advisory