LiveActive security incident?Get immediate response
CVE Record

CVE-2026-5388: justhtml before 1.15.0 Multiple Security Issues

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

justhtml versions before 1.15.0 may allow attacker-controlled content to escape sanitization and execute active HTML or JavaScript. Successful abuse could compromise information displayed or handled by an affected application. Risk depends heavily on how the library is configured; several issues concern helper APIs, Markdown passthrough, programmatic DOM construction, and custom sanitization policies rather than the default configuration.

Executive priority

Prioritize immediate inventory and rapid upgrading for internet-facing or multi-tenant systems that sanitize untrusted content. Escalate applications using Markdown passthrough, custom policies, helper APIs, or programmatic DOM construction. Default-only deployments may have narrower exposure, but the critical rating and potential script execution justify prompt verification rather than assuming safety.

Technical view

The flaws affect URL-cleaning helpers, HTML serialization, Markdown passthrough, and custom-policy edge cases. Bypasses include encoded script-scheme URLs, backslash URL handling, markup-breaking names or comments, textarea termination, and preserved style, refresh, or base elements. Most custom-policy cases reportedly do not affect the default sanitize=True configuration.

Likely exposure

Exposure is most likely where applications process untrusted content with justhtml before 1.15.0, particularly through URL helper APIs, html_passthrough=True, programmatic element construction, custom policies, or transformation pipelines. Deployments using only the default sanitize=True behavior may avoid most custom-policy issues, but their exact exposure still requires configuration and data-flow review.

Exploitation context

The supplied record reports remotely reachable, low-complexity impact without required privileges or user interaction and assigns CVSS 9.8. However, it does not establish active exploitation, and the CVE is not listed as KEV in the supplied bundle. Treat practical exploitability as configuration-dependent and validate whether attacker-controlled input reaches affected paths.

Researcher notes

The advisory groups multiple behaviors under one CVE, so reachability should be assessed per API and configuration. Preserve context when testing: URL parsing, serialization, Markdown conversion, browser interpretation, and custom transforms may interact. The supplied evidence does not quantify affected deployments or confirm exploitation in the wild. Avoid generalizing custom-policy findings to default sanitize=True without reproducing the relevant data flow.

Mitigation direction

  • Upgrade justhtml to version 1.15.0 or later.
  • Inventory applications and dependencies using justhtml versions before 1.15.0.
  • Disable html_passthrough=True where raw HTML preservation is unnecessary.
  • Review custom policies, transform pipelines, URL helpers, and programmatic DOM construction.
  • Follow the vendor advisory for any additional configuration-specific guidance.

Validation and detection

  • Confirm the deployed and transitive justhtml versions in every application environment.
  • Trace untrusted input into sanitization, Markdown, URL-cleaning, serialization, and transformation paths.
  • Identify uses of html_passthrough=True and non-default sanitization policies.
  • Run defensive regression tests covering the bypass classes described by the vendor.
  • Verify sanitized output cannot introduce active HTML or JavaScript in its final rendering context.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-20: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-5388 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
1ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: total

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9VulnCheck
9.3CVSS 4.0CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheck

Vulnerability scoring details

Base CVSS 4.0 score

9.3Critical
CVSS 4.0 vector shape for CVE-2026-5388Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
EmilStenstromjusthtml0, 1.15.0unaffected
Weakness

CWE details

CWE-20

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.