CVE-2026-5388
CVE-2026-5388 · justhtml before 1.15.0 Multiple Security Issues
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.
CVSS 9.3 · Critique · EPSS 0,6% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: python
Produits et versions concernés
justhtml
- Versions du logiciel
- ≥ 0, < 1.15.0: Concernée (semver)
- 1.15.0: Non concernée (semver)
Mettez à jour vers 1.15.0
justhtml PyPI
- Versions du logiciel
- 0.1.0
- 0.10.0
- 0.11.0
- 0.12.0
- 0.13.0
- 0.13.1
- 0.14.0
- 0.15.0
- 0.16.0
- 0.17.0
- 0.18.0
- 0.19.0
- 0.2.0
- 0.20.0
- 0.21.0
- 0.22.0
- 0.23.0
- 0.24.0
- 0.25.0
- 0.26.0
- 0.27.0
- 0.28.0
- 0.29.0
- 0.3.0
- 0.30.0
- 0.31.0
- 0.32.0
- 0.33.0
- 0.34.0
- 0.35.0
- 0.36.0
- 0.37.0
- 0.38.0
- 0.39.0
- 0.4.0
- 0.40.0
- 0.5.0
- 0.5.1
- 0.5.2
- 0.6.0
- 0.7.0
- 0.8.0
- 0.9.0
- 1.0.0
- 1.1.0
- 1.10.0
- 1.11.0
- 1.12.0
- 1.13.0
- 1.14.0
- 1.2.0
- 1.3.0
- 1.4.0
- 1.5.0
- 1.6.0
- 1.7.0
- 1.8.0
- 1.9.0
- 1.9.1
- Plages de versions concernées
- ECOSYSTEM: < 1.15.0
Mettez à jour vers 1.15.0