CVE-2026-5388: Critical XSS Sanitization Bypass in justhtml

Overview

CVE-2026-5388 is a critical (CVSS 9.8) cross-site scripting vulnerability in justhtml, a Python HTML sanitization library. Versions prior to 1.15.0 contain multiple independent security failures across URL sanitization helpers, HTML serialization logic, Markdown passthrough mode, and several custom sanitization-policy edge cases.

Depending on how justhtml is configured, an attacker can bypass sanitization entirely and inject arbitrary HTML or JavaScript into output rendered by an application.

Technical Details

The vulnerability encompasses several distinct weaknesses within justhtml's pipeline:

1. URL Sanitization Bypass (clean_url_value / clean_url_in_js_string)

The clean_url_value and clean_url_in_js_string helpers fail to correctly handle certain URL schemes and encoding sequences. An attacker can craft a URL using a lesser-known scheme (such as javascript: with unusual whitespace or Unicode normalization) that passes the helper's allow-list checks but executes JavaScript in the browser when rendered in an href or src attribute.

2. HTML Serialization Flaws

The HTML serializer used when re-rendering sanitized DOM trees does not correctly escape certain attribute values in all contexts. In particular, attribute values adjacent to unquoted HTML attributes, or values inside SVG and MathML namespaces, may be serialized in ways that allow injection of additional attribute data or event handlers.

3. Markdown Passthrough (html_passthrough=True)

When justhtml is configured with html_passthrough=True to allow raw HTML within Markdown content, the library applies an insufficiently strict secondary sanitization pass to the raw HTML blocks. Certain HTML constructs that are invalid per spec but accepted by major browsers slip through the pass-through sanitizer unchanged.

4. Custom Policy Edge Cases

Several edge cases exist in the policy evaluation logic when users define custom sanitization policies combining allow-listed tags, attribute filters, and URL validators. The interaction between multiple active policy rules can create gaps where tags or attributes are incorrectly permitted.

CVSS Breakdown

Impact

Applications using justhtml to sanitize user-supplied HTML before displaying it to other users are at risk of stored or reflected XSS attacks. A successful exploit could allow an attacker to:

• Execute arbitrary JavaScript in the context of a victim's browser session
• Steal session cookies, authentication tokens, or other sensitive data
• Perform actions on behalf of the victim, including account takeover
• Inject phishing content or malware delivery scripts into web pages

The severity is particularly high because justhtml is often used as the primary trust boundary for user-generated content — a bypass means untrusted input reaches the DOM without restriction.

Affected Versions

All versions of justhtml before 1.15.0 are affected.

Remediation

Upgrade to justhtml 1.15.0 or later immediately. The 1.15.0 release includes comprehensive fixes for all reported bypass vectors.

Additional hardening steps:

1. Enable a strong Content Security Policy (CSP) to limit script execution even if sanitization is bypassed.
2. Apply HttpOnly and Secure flags to session cookies to mitigate cookie theft via XSS.
3. Review any custom sanitization policies for interactions that might allow unintended tags or attributes.
4. Avoid using html_passthrough=True unless strictly necessary; if used, apply additional validation on the raw HTML blocks.

References

• NVD: CVE-2026-5388
• justhtml on PyPI
• OWASP: Cross-Site Scripting (XSS)
• Content Security Policy Reference