CVE-2026-5388

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.15.0

Description Multiple security issues exist in URL sanitization helpers, HTML serialization, and Markdown passthrough. An attacker can bypass sanitization to inject active HTML and JavaScript through several methods: using encoded javascript: URLs, backslash-based relative URLs that resolve as remote hosts, programmatic element or attribute names that break markup, or HTML comments. Additionally, raw </textarea> tags can be reintroduced via Markdown passthrough when html passthrough=True is used. Certain custom policies may also preserve <style>, <meta http-equiv=refresh>, or <base href> tags. These issues primarily affect helper APIs, programmatic DOM construction, custom policies, transform pipelines, and configurations where html passthrough=True is enabled, rather than the default sanitize=True configuration. The affected helper functions include clean url value() and clean url in js string().

Recommendations Update to version 1.15.0 or later. As a temporary mitigation, avoid using the html passthrough=True configuration. Restrict the use of the clean url value() and clean url in js string() functions until the update is applied.