CVE-2026-5388
CVE-2026-5388 · justhtml before 1.15.0 Multiple Security Issues
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.
CVSS 9.3 · Crítica · EPSS 0,6% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: python
Productos y versiones afectados
justhtml
- Versiones
- ≥ 0, < 1.15.0: Afectada (semver)
- 1.15.0: No afectada (semver)
Actualiza a 1.15.0
justhtml PyPI
- Versiones
- 0.1.0
- 0.10.0
- 0.11.0
- 0.12.0
- 0.13.0
- 0.13.1
- 0.14.0
- 0.15.0
- 0.16.0
- 0.17.0
- 0.18.0
- 0.19.0
- 0.2.0
- 0.20.0
- 0.21.0
- 0.22.0
- 0.23.0
- 0.24.0
- 0.25.0
- 0.26.0
- 0.27.0
- 0.28.0
- 0.29.0
- 0.3.0
- 0.30.0
- 0.31.0
- 0.32.0
- 0.33.0
- 0.34.0
- 0.35.0
- 0.36.0
- 0.37.0
- 0.38.0
- 0.39.0
- 0.4.0
- 0.40.0
- 0.5.0
- 0.5.1
- 0.5.2
- 0.6.0
- 0.7.0
- 0.8.0
- 0.9.0
- 1.0.0
- 1.1.0
- 1.10.0
- 1.11.0
- 1.12.0
- 1.13.0
- 1.14.0
- 1.2.0
- 1.3.0
- 1.4.0
- 1.5.0
- 1.6.0
- 1.7.0
- 1.8.0
- 1.9.0
- 1.9.1
- Intervalos de versiones afectados
- ECOSYSTEM: < 1.15.0
Actualiza a 1.15.0