CVE-2026-5388 - justhtml before 1.15.0 Multiple Security Issues
Brief
CVE ID : CVE-2026-5388
Published : Aug. 23, 2026, 2:16 p. m.
- 6 hours, 54 minutes ago
Description : justhtml before 1.
- 0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases.
Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw reintroduction through Markdown passthrough, or preserved / / tags in custom policies.