CVE-2026-5388

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.

Summary

justhtml 1.15.0 includes multiple security fixes affecting URL sanitization helpers, HTML serialization, Markdown passthrough, and several custom sanitization-policy edge cases.

These issues have different impact levels and do not all affect the default configuration in the same way.

Affected versions

• justhtml <= 1.14.0

Fixed version

• justhtml 1.15.0 released on April 9, 2026

Impact overview

Helper and serialization issues

These issues could affect applications using JustHTML helpers or programmatic DOM construction, even outside the default HTML sanitization path.

• JustHTML.clean_url_value(...) and clean_url_in_js_string(...) could accept URL values such as javascript&#58..., which became active javascript: URLs after HTML attribute parsing.
• URL sanitization could treat values like \\evil.example/x or /\\evil.example/x as safe relative URLs even though browsers could resolve them as remote requests.
• Malformed bracketed hosts such as https://[evil.example]/x could raise exceptions and crash sanitization when host allowlists were used.
• Programmatic element or attribute names containing markup-breaking characters could be serialized into active HTML.
• Programmatic HTML comments containing --> could break out of the comment and inject live markup.

Markdown passthrough issue

• to_markdown(html_passthrough=True) could reintroduce active HTML from sanitized <textarea> content by emitting a raw closing </textarea> sequence.

Custom policy issues

These issues affected custom policies more than the default safe configuration.

• a[ping] was handled as a single URL even though browsers interpret it as a space-separated URL list.
• attributionsrc was not treated as URL-bearing and could preserve attacker-controlled reporting endpoints.
• link[imagesrcset] was not treated as URL-bearing and could preserve attacker-controlled image candidates.
• Preserved <meta http-equiv="refresh"> tags could keep redirect targets without URL-policy enforcement.
• Preserved <base href> tags could rewrite how later relative URLs resolved in the browser.
• Preserved <style> blocks could keep resource-loading CSS such as @import, url(...), or image-set(...).
• Mixed-case attribute names in custom transform pipelines could bypass or confuse security-related transforms such as DropAttrs(...), DropUrlAttrs(...), AllowStyleAttrs(...), and MergeAttrs(...).

Default configuration

Most of the custom-policy issues above did not affect the default JustHTML(..., sanitize=True) behavior.

The main exceptions were:

• helper APIs such as clean_url_value(...)
• programmatic DOM / serializer usage
• applications explicitly using html_passthrough=True
• applications using custom policies or custom transform pipelines

Recommended action

Upgrade to justhtml 1.15.0.

If you cannot upgrade immediately:

• avoid html_passthrough=True for untrusted content
• avoid preserving <style>, <meta http-equiv="refresh">, and <base href> in custom policies
• avoid allowing ping, attributionsrc, or imagesrcset unless you explicitly validate them
• avoid serializing untrusted programmatic node names, attribute names, or comment data

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.

Summary

justhtml 1.15.0 includes multiple security fixes affecting URL sanitization helpers, HTML serialization, Markdown passthrough, and several custom sanitization-policy edge cases.

These issues have different impact levels and do not all affect the default configuration in the same way.

Affected versions

• justhtml <= 1.14.0

Fixed version

• justhtml 1.15.0 released on April 9, 2026

Impact overview

Helper and serialization issues

These issues could affect applications using JustHTML helpers or programmatic DOM construction, even outside the default HTML sanitization path.

• JustHTML.clean_url_value(...) and clean_url_in_js_string(...) could accept URL values such as javascript&#58..., which became active javascript: URLs after HTML attribute parsing.
• URL sanitization could treat values like \\evil.example/x or /\\evil.example/x as safe relative URLs even though browsers could resolve them as remote requests.
• Malformed bracketed hosts such as https://[evil.example]/x could raise exceptions and crash sanitization when host allowlists were used.
• Programmatic element or attribute names containing markup-breaking characters could be serialized into active HTML.
• Programmatic HTML comments containing --> could break out of the comment and inject live markup.

Markdown passthrough issue

• to_markdown(html_passthrough=True) could reintroduce active HTML from sanitized <textarea> content by emitting a raw closing </textarea> sequence.

Custom policy issues

These issues affected custom policies more than the default safe configuration.

• a[ping] was handled as a single URL even though browsers interpret it as a space-separated URL list.
• attributionsrc was not treated as URL-bearing and could preserve attacker-controlled reporting endpoints.
• link[imagesrcset] was not treated as URL-bearing and could preserve attacker-controlled image candidates.
• Preserved <meta http-equiv="refresh"> tags could keep redirect targets without URL-policy enforcement.
• Preserved <base href> tags could rewrite how later relative URLs resolved in the browser.
• Preserved <style> blocks could keep resource-loading CSS such as @import, url(...), or image-set(...).
• Mixed-case attribute names in custom transform pipelines could bypass or confuse security-related transforms such as DropAttrs(...), DropUrlAttrs(...), AllowStyleAttrs(...), and MergeAttrs(...).

Default configuration

Most of the custom-policy issues above did not affect the default JustHTML(..., sanitize=True) behavior.

The main exceptions were:

• helper APIs such as clean_url_value(...)
• programmatic DOM / serializer usage
• applications explicitly using html_passthrough=True
• applications using custom policies or custom transform pipelines

Recommended action

Upgrade to justhtml 1.15.0.

If you cannot upgrade immediately:

• avoid html_passthrough=True for untrusted content
• avoid preserving <style>, <meta http-equiv="refresh">, and <base href> in custom policies
• avoid allowing ping, attributionsrc, or imagesrcset unless you explicitly validate them
• avoid serializing untrusted programmatic node names, attribute names, or comment data