CVE-2026-4671: justhtml before 1.18.0 Denial of Service via CSS Selector
justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings (via query(), matches(), or selector-based transforms), run selector matching over very large untrusted documents, construct DOM trees from untrusted structure, or enable linkification over attacker-controlled text may consume disproportionate CPU or memory. Triggers include oversized selectors, large selector lists, oversized compound selectors, long combinator chains, deeply nested functional pseudo-classes, repeated token/positional matching, cyclic DOM graphs causing non-terminating traversal, and punctuation-heavy or trailing-bracket linkification input. These are availability-only concerns and do not by themselves allow script execution, data disclosure, or sanitizer bypass. Default JustHTML(sanitize=True) usage is not expected to be exposed, since selectors are normally supplied by application code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
justhtmlto a version that resolves this vulnerability.Fixed in 1.18.0
Event History
Frequently Asked Questions
Which deployments are most likely to be exposed?
Applications are most likely to be exposed when they evaluate attacker-controlled selectors through query(), matches(), or selector-based transforms; run matching against very large untrusted documents; build DOM trees from untrusted structure; or linkify attacker-controlled text. Default JustHTML(sanitize=True) use is not expected to be exposed because selectors are normally application-supplied.
What can an unauthenticated attacker achieve?
An attacker can cause disproportionate CPU or memory consumption, resulting in denial of service. The issue is availability-only and does not itself provide script execution, data disclosure, or a sanitizer bypass.
What inputs or structures can trigger the resource exhaustion?
Relevant triggers include oversized selectors or selector lists, large compound selectors, long combinator chains, deeply nested functional pseudo-classes, repeated token or positional matching, and cyclic DOM graphs that do not terminate traversal. Linkification can also be stressed with punctuation-heavy input or text ending in trailing brackets.
What should be prioritized if immediate upgrade is not possible?
Prioritize preventing untrusted selector strings from reaching query(), matches(), or selector-based transforms, and limit the size and complexity of untrusted documents and DOM structures. Avoid linkifying unrestricted attacker-controlled text, especially punctuation-heavy input, until the affected component can be updated.