GHSA-892m-gcq8-2468: High severity pip/justhtml vulnerability
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v7cf-c9rm-wm3j. This link is maintained to preserve external references.
Original Description justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls populateselectedcontent(), which recursively traverses the DOM tree via findelements()/findelement() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
justhtmlto a version that resolves this vulnerability.Fixed in 1.10.0 - Compensating control
If upgrading is not immediately possible, prevent external users from providing attacker-controlled HTML to JustHTML() parsing endpoints to reduce the chance of triggering uncontrolled recursion (e.g., restrict/validate or gate HTML inputs at the application boundary).