Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-5388 critical CVSS 9.8

Vulnerability in justhtml (CVE-2026-5388)

Summary

Vulnerability in justhtml (CVE-2026-5388). Successful exploitation can lead to full system takeover.

Original description

The description as published by the source.

Summary

justhtml 1.15.0 includes multiple security fixes affecting URL sanitization helpers, HTML serialization, Markdown passthrough, and several custom sanitization-policy edge cases.

These issues have different impact levels and do not all affect the default configuration in the same way.

Affected versions

  • justhtml <= 1.14.0

Fixed version

  • justhtml 1.15.0 released on April 9, 2026

Impact overview

Helper and serialization issues

These issues could affect applications using JustHTML helpers or programmatic DOM construction, even outside the default HTML sanitization path.

  • JustHTML.clean_url_value(...) and clean_url_in_js_string(...) could accept URL values such as javascript&#58..., which became active javascript: URLs after HTML attribute parsing.
  • URL sanitization could treat values like \\evil.example/x or /\\evil.example/x as safe relative URLs even though browsers could resolve them as remote requests.
  • Malformed bracketed hosts such as https://[evil.example]/x could raise exceptions and crash sanitization when host allowlists were used.
  • Programmatic element or attribute names containing markup-breaking characters could be serialized into active HTML.
  • Programmatic HTML comments containing --> could break out of the comment and inject live markup.

Markdown passthrough issue

  • to_markdown(html_passthrough=True) could reintroduce active HTML from sanitized content by emitting a raw closing sequenc…

Source: NIST National Vulnerability Database NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-5388 has been found in justhtml.
Successful exploitation can lead to full system takeover. CVSS score: 9.8/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "justhtml CVE-2026-5388" on the vendor's site.

CVE-2026-5388 (justhtml) — CWE-20 / CVSS v3 9.8
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-20) exists in justhtml.

📍 Affected scope

Check the vendor advisory for the affected versions of justhtml.

🔥 Severity

Severity: Critical (CVSS 9.8/10). Successful exploitation can lead to full system takeover.

🔧 How to fix

Update to the patched release per vendor advisory.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'justhtml' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'justhtml' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で justhtml を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

PyPI justhtml
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details