CVE-2026-5388 in justhtml
Summary
by MITRE • 08/23/2026
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/23/2026
The justhtml library prior to version 1.15.0 contains multiple critical security vulnerabilities related to URL sanitization, HTML serialization, and Markdown passthrough mechanisms that can lead to Cross-Site Scripting attacks when specific configuration options are enabled or custom policies are utilized. These flaws stem from insufficient validation of user-supplied input within helper functions such as clean_url_value and clean_url_in_js_string, which fail to adequately neutralize malicious payloads before they are processed by the HTML serializer. The core issue lies in the library's handling of edge cases where encoded characters, backslashes, or specific markup structures can bypass existing sanitization rules, allowing an attacker to inject active content into a web page that is subsequently rendered by a victim user agent.
One significant vector involves the mishandling of URL schemes and relative paths during serialization. Attackers can exploit the way justhtml resolves relative URLs by using backslash-based syntax or encoded javascript: URIs to trick the sanitizer into treating malicious scripts as valid, safe resources. This bypass occurs because the validation logic does not strictly enforce scheme whitelisting in all code paths, particularly when dealing with programmatic DOM construction rather than simple string parsing. Consequently, a crafted URL attribute can execute arbitrary JavaScript code upon interaction or even automatically depending on how the resulting HTML is embedded within the target application context.
Another critical flaw exists in the Markdown passthrough feature when enabled via html_passthrough=True. In this mode, raw closing tags such as </textarea> are reintroduced into the output without proper escaping or sanitization. This allows an attacker to break out of surrounding HTML contexts and inject arbitrary markup directly into the document flow. Since many web applications use textarea elements for user input display, failing to escape these specific sequences enables immediate script execution if subsequent content is interpreted as executable code by the browser's rendering engine.
Furthermore, custom sanitization policies defined within justhtml suffer from incomplete coverage of dangerous HTML tags and attributes. Specifically, tags such as <style>, <meta http-equiv=refresh>, and <base href> are preserved in certain policy configurations despite their potential for abuse. The <style> tag can be used to inject CSS-based attacks or exfiltrate data through style properties that trigger network requests. The meta refresh tag allows for automatic redirection to malicious sites, while the base href tag can alter the context of all relative URLs on a page, facilitating phishing attacks or resource loading from attacker-controlled domains. These issues primarily affect helper APIs and custom transform pipelines rather than the default sanitize=True configuration, but they represent severe risks in applications that rely on flexible sanitization strategies for complex content types.
From an industry standard perspective, these vulnerabilities align with CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The specific techniques involving encoded URLs and backslash resolution also relate to CWE-601 URL Redirection to Untrusted Site. Additionally, the exploitation of meta refresh tags corresponds to CWE-436 Interpretation Conflict, where different parsers interpret input differently leading to security bypasses. In terms of MITRE ATT&CK mapping, these flaws facilitate techniques under Tactic TA0001 Initial Access and TA0005 Defense Evasion, specifically leveraging Injection (T1190) and Client-side Payload Injection (T1059).
To mitigate these risks, developers must upgrade to justhtml version 1.15.0 or later where these sanitization logic errors have been corrected. For applications unable to immediately update, it is crucial to avoid using the html_passthrough=True option with untrusted input and to rigorously audit any custom sanitization policies to ensure that dangerous tags like style, meta refresh, and base href are explicitly blocked unless absolutely necessary for legitimate functionality. Furthermore, implementing Content Security Policy headers can provide an additional layer of defense by restricting the sources from which scripts and other resources can be loaded, thereby reducing the impact if a bypass is successfully executed. Regular security testing using automated static analysis tools configured to detect XSS patterns in HTML templates will also help identify similar vulnerabilities before deployment.