---
id: CVE-2026-5388
title: >-
  justhtml before 1.15.0 contains multiple security issues in URL sanitization
  helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown
  passthrough (html_passthrough=True), and several custom sanitization-policy
  edge …
summary: >-
  justhtml before 1.15.0 contains multiple security issues in URL sanitization
  helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown
  passthrough (html_passthrough=True), and several custom sanitization-policy
  edge …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-20
vendor: justhtml
product: justhtml
affected:
  - justhtml < 1.15.0
patched:
  - justhtml 1.15.0
published: '2026-08-23'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T16:10:00.220'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-5388'
references:
  - url: >-
      https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-c9vm-hv86-f23r
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/justhtml-before-multiple-security-issues
    label: disclosure@vulncheck.com
  - url: 'https://github.com/EmilStenstrom/justhtml'
  - url: 'https://github.com/EmilStenstrom/justhtml/compare/v1.14.0...v1.15.0'
  - url: 'https://github.com/EmilStenstrom/justhtml/releases/tag/v1.15.0'
tags:
  - nvd
  - osv
  - pip
epss: 0.00587
epssPercentile: 0.47876
aliases:
  - GHSA-c9vm-hv86-f23r
ecosystem: pip
ingestedAt: '2026-08-24T19:25:44.153Z'
---

## Overview

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-5388)

Affected packages:

- `justhtml < 1.15.0`

Patched in:

- `justhtml 1.15.0`

Source: https://osv.dev/vulnerability/GHSA-c9vm-hv86-f23r