A critical set of sanitization flaws in the Python justhtml library before version 1.15.0 lets attackers slip active HTML and JavaScript past filtering, depending on how the library is configured.
What Is It
CVE-2026-5388 covers multiple security issues in justhtml prior to 1.15.0, classified as CWE-20 (Improper Input Validation). The defects span the URL sanitization helpers (clean_url_value and clean_url_in_js_string), HTML serialization, Markdown passthrough when html_passthrough=True, and several custom sanitization-policy edge cases.
Reported bypass techniques include encoded javascript: URLs, backslash-based relative URLs that resolve to remote hosts, markup-breaking programmatic element or attribute names and HTML comments, raw </textarea> reintroduction through Markdown passthrough, and preserved <style>, <meta http-equiv=refresh>, and <base href> tags in custom policies.
Why It Matters
A sanitizer that can be bypassed is a direct path to injecting attacker-controlled script into pages that were assumed safe; the whole point of the library is to prevent exactly that. The practical severity depends heavily on the consuming application: what untrusted input reaches the sanitizer, where the output is rendered, and which of the affected code paths are in use.
VulnCheck assigns a CVSS v3.1 base score of 9.8 (CRITICAL, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS v4.0 score of 9.3 (CRITICAL). Treat those numbers as a vendor-assigned upper bound rather than a description of a typical deployment. The v3.1 vector in particular is a poor fit for a sanitizer bypass in a library: injection of active content normally lands in a victim's browser session, which argues for user interaction and a scope change rather than UI:N/S:U, and a filter bypass does not inherently produce the high availability impact the vector claims. NVD has not yet published its own analysis, so no independent score corroborates these metrics.
CVE-2026-5388 does not appear in the CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog). That means CISA has not added it, so no BOD 22-01 federal remediation deadline applies; it is not evidence that exploitation has not occurred, only that none has been publicly cataloged.
What's Vulnerable
- Vendor: EmilStenstrom
- Product:
justhtml(pkg:pypi/justhtml) - Affected: all versions before 1.15.0
- Unaffected: 1.15.0 and later
Per the advisory, most custom-policy issues do not affect the default sanitize=True configuration. Exposure concentrates in the helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies or transform pipelines. Audit for those patterns first.
Patch Status
Fixed in justhtml 1.15.0. Upgrade to 1.15.0 or later. The NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-5388) was published 2026-08-23 with a status of "Received," so scoring and metadata may still change.
Sources
- GitHub Security Advisory GHSA-c9vm-hv86-f23r; https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-c9vm-hv86-f23r
- VulnCheck Advisory: justhtml multiple security issues; https://www.vulncheck.com/advisories/justhtml-before-multiple-security-issues
- NVD entry for CVE-2026-5388; https://nvd.nist.gov/vuln/detail/CVE-2026-5388
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog