← Back to the live CVE advisory feed

CVE-2026-5388: justhtml

Severity

9.3 (CRITICAL)

Vendor

JUSTHTML BEFORE

Affected versions

0 through before 1.15.0

Fixed version

1.15.0

Patch status

Patched

Published

2026-08-23T14:16:53.470

Modified

2026-08-23T14:16:53.470

Why it matters

Critical vulnerability requiring immediate validation against your environment.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.

Technical summary

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw reintroduction through Markdown passthrough, or preserved // tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.

View the official NVD record for CVE-2026-5388

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.