CVE-2026-7808
CVE-2026-7808 · justhtml before 1.16.0 Multiple Security Issues via Sanitization
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML(..., sanitize=True) path for ordinary parsed HTML: mutating or reusing sanitization policy objects (including exported defaults) could weaken later sanitization; programmatic DOM input to sanitize()/sanitize_dom() could miss mixed-case tag names (e.g., ScRiPt, StYlE); crafted programmatic doctype names could serialize into active markup; and custom policies preserving SVG or MathML could allow animation elements, presentation attributes with external url(...) references, or DOM trees mislabeled as namespace="html" to bypass foreign-content checks. Fixed in 1.16.0.
CVSS 9.3 · Kritisch · EPSS 0,6% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: python
Betroffene Produkte und Versionen
justhtml
- Softwareversionen
- ≥ 0, < 1.16.0: Betroffen (semver)
- 1.16.0: Nicht betroffen (semver)
Auf 1.16.0 aktualisieren
justhtml PyPI
- Softwareversionen
- 0.1.0
- 0.10.0
- 0.11.0
- 0.12.0
- 0.13.0
- 0.13.1
- 0.14.0
- 0.15.0
- 0.16.0
- 0.17.0
- 0.18.0
- 0.19.0
- 0.2.0
- 0.20.0
- 0.21.0
- 0.22.0
- 0.23.0
- 0.24.0
- 0.25.0
- 0.26.0
- 0.27.0
- 0.28.0
- 0.29.0
- 0.3.0
- 0.30.0
- 0.31.0
- 0.32.0
- 0.33.0
- 0.34.0
- 0.35.0
- 0.36.0
- 0.37.0
- 0.38.0
- 0.39.0
- 0.4.0
- 0.40.0
- 0.5.0
- 0.5.1
- 0.5.2
- 0.6.0
- 0.7.0
- 0.8.0
- 0.9.0
- 1.0.0
- 1.1.0
- 1.10.0
- 1.11.0
- 1.12.0
- 1.13.0
- 1.14.0
- 1.15.0
- 1.2.0
- 1.3.0
- 1.4.0
- 1.5.0
- 1.6.0
- 1.7.0
- 1.8.0
- 1.9.0
- 1.9.1
- Betroffene Versionsbereiche
- ECOSYSTEM: < 1.16.0
Auf 1.16.0 aktualisieren