CVE-2026-5388
CVE-2026-5388 · justhtml before 1.15.0 Multiple Security Issues
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.
CVSS 9.3 · Kritisch · EPSS 0,6% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: python
Betroffene Produkte und Versionen
justhtml
- Softwareversionen
- ≥ 0, < 1.15.0: Betroffen (semver)
- 1.15.0: Nicht betroffen (semver)
Auf 1.15.0 aktualisieren
justhtml PyPI
- Softwareversionen
- 0.1.0
- 0.10.0
- 0.11.0
- 0.12.0
- 0.13.0
- 0.13.1
- 0.14.0
- 0.15.0
- 0.16.0
- 0.17.0
- 0.18.0
- 0.19.0
- 0.2.0
- 0.20.0
- 0.21.0
- 0.22.0
- 0.23.0
- 0.24.0
- 0.25.0
- 0.26.0
- 0.27.0
- 0.28.0
- 0.29.0
- 0.3.0
- 0.30.0
- 0.31.0
- 0.32.0
- 0.33.0
- 0.34.0
- 0.35.0
- 0.36.0
- 0.37.0
- 0.38.0
- 0.39.0
- 0.4.0
- 0.40.0
- 0.5.0
- 0.5.1
- 0.5.2
- 0.6.0
- 0.7.0
- 0.8.0
- 0.9.0
- 1.0.0
- 1.1.0
- 1.10.0
- 1.11.0
- 1.12.0
- 1.13.0
- 1.14.0
- 1.2.0
- 1.3.0
- 1.4.0
- 1.5.0
- 1.6.0
- 1.7.0
- 1.8.0
- 1.9.0
- 1.9.1
- Betroffene Versionsbereiche
- ECOSYSTEM: < 1.15.0
Auf 1.15.0 aktualisieren