CVE-2026-5388: justhtml before 1.15.0 Multiple Security Issues

Q: Which deployments are most likely to be exposed?

Deployments using the URL sanitization helper APIs, programmatic DOM construction, Markdown with html_passthrough=True, or custom sanitization policies and transform pipelines are primarily affected. Most custom-policy issues do not affect the default sanitize=True configuration.

Q: What attacker-controlled input can trigger these issues?

An attacker may be able to bypass sanitization through encoded javascript: URLs, backslash-based relative URLs that resolve as remote hosts, markup-breaking element or attribute names and HTML comments, or raw </textarea> content reintroduced through Markdown passthrough. Custom policies that preserve style tags, meta refresh tags, or base href tags can also enable active content or unsafe navigation behavior.

Published Aug 23, 2026

Updated

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (cleanurlvalue/cleanurlinjsstring), HTML serialization, Markdown passthrough (htmlpassthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, htmlpassthrough=True, and custom policies/transform pipelines.

Affected Software

1 affected component

justhtml<1.15.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade justhtml to a version that resolves this vulnerability.
Fixed in 1.15.0
Configuration
Set justhtml html_passthrough to False to avoid Markdown/HTML passthrough issues that preserve active HTML/JavaScript.
justhtml html_passthrough = False

Event History

Aug 23, 2026

CVE Published

via MITRE·01:34 PM

Data Sourced

via MITRE·01:34 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are most likely to be exposed?

Deployments using the URL sanitization helper APIs, programmatic DOM construction, Markdown with html_passthrough=True, or custom sanitization policies and transform pipelines are primarily affected. Most custom-policy issues do not affect the default sanitize=True configuration.

What attacker-controlled input can trigger these issues?

An attacker may be able to bypass sanitization through encoded javascript: URLs, backslash-based relative URLs that resolve as remote hosts, markup-breaking element or attribute names and HTML comments, or raw </textarea> content reintroduced through Markdown passthrough. Custom policies that preserve style tags, meta refresh tags, or base href tags can also enable active content or unsafe navigation behavior.

Are applications using the default sanitization configuration affected?

Most of the custom-policy issues are not expected to affect the default sanitize=True configuration. The advisory specifically identifies helper APIs, programmatic DOM construction, html_passthrough=True, and custom policy or transform usage as the main exposure areas.

What can be done if upgrading is not immediately possible?

Avoid html_passthrough=True for untrusted Markdown, avoid relying on the affected URL sanitization helpers for untrusted URLs, and review custom policies and transforms for preserved style, meta http-equiv=refresh, and base href tags. Do not permit attacker-controlled programmatic element names, attribute names, or HTML comments to reach serialization.