PT-2026-36663 · Pypi · Justhtml

Published

2026-04-22

·

Updated

2026-04-22

CVSS v4.0

6.0

Medium

VectorAV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N

Summary

justhtml 1.17.0 fixes multiple security issues in sanitization, serialization, and programmatic DOM handling.
Most of these issues affected advanced or custom configurations rather than the default safe path.

Affected versions

  • justhtml <= 1.16.0

Fixed version

  • justhtml 1.17.0 released on April 19, 2026

Impact

Custom SVG / MathML sanitization policies

Custom policies that preserved foreign namespaces could allow dangerous content to survive sanitization, including:
  • active HTML integration points such as SVG <foreignObject>, MathML <annotation-xml encoding="text/html">, SVG <title> / <desc>, and MathML text integration points
  • mutation-XSS parser-differential payloads that looked inert in memory but became active HTML after reparse
  • SVG filter="url(...)" attributes that could trigger external fetches
These issues affected:
  • JustHTML(..., sanitize=True) with custom foreign-namespace policies
  • sanitize() / sanitize dom()
  • low-level terminal Sanitize(...) transform execution

Preserved <style> handling

Constructor-time sanitization and explicit Sanitize(...) transforms did not fully match sanitize() / sanitize dom() when custom policies preserved <style>.
That could leave resource-loading CSS such as @import or background-image:url(...) in sanitized output from HTML string input.

Programmatic DOM serialization

Programmatic script, style, and Comment(...) nodes could still serialize into active markup in some edge cases.
This could affect applications that build or mutate DOM trees directly before calling to html() or to markdown(html passthrough=True).

Cache mutation and DOM cycle handling

Two lower-severity hardening fixes were included:
  • compiled sanitize-pipeline caches could be mutated after warming and weaken later sanitization
  • parent/child cycles in programmatic DOM trees could cause infinite loops in operations such as to html() and sanitize dom()

Default configuration

Most of the issues above did not affect ordinary parsed HTML with the default JustHTML(..., sanitize=True) configuration.
The main risk areas were:
  • custom policies that preserve SVG or MathML
  • custom policies that preserve <style>
  • programmatic DOM construction or mutation
  • low-level direct sanitizer/transform APIs

Recommended action

Upgrade to justhtml 1.17.0.
If users cannot upgrade immediately:
  • avoid preserving SVG or MathML for untrusted input
  • avoid preserving <style> for untrusted input
  • avoid mutating programmatic DOM trees with untrusted script, style, or comment content
  • avoid mutating warmed policy internals or sanitizer caches

Credit

Discovered during an internal security review of justhtml.

Fix

XSS

Infinite Loop

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79CWE-436CWE-471CWE-835

Related Identifiers

GHSA-VRX2-77F2-WW34

Affected Products

Justhtml