CVE-2026-5388: justhtml XSS Vulnerability

CVE-2026-5388 Overview

CVE-2026-5388 affects justhtml versions before 1.15.0, a Python HTML sanitization library. The library contains multiple security issues across URL sanitization helpers (clean_url_value and clean_url_in_js_string), HTML serialization, Markdown passthrough, and custom sanitization-policy edge cases. Attackers can bypass sanitization to inject active HTML and JavaScript depending on configuration. Injection vectors include encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking element or attribute names, HTML comments, raw </textarea> reintroduction through Markdown passthrough, and preserved <style>, <meta http-equiv=refresh>, and <base href> tags in custom policies.

Critical Impact
Attackers can achieve cross-site scripting (XSS) and HTML injection against applications relying on justhtml helper APIs, html_passthrough=True, or custom sanitization policies.

Affected Products

justhtml Python library versions prior to 1.15.0
Applications using clean_url_value or clean_url_in_js_string helper APIs
Applications enabling html_passthrough=True or custom sanitization policies and transform pipelines

Discovery Timeline

2026-08-23 - CVE-2026-5388 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-5388

Vulnerability Analysis

CVE-2026-5388 groups multiple sanitization bypasses in justhtml under a single advisory. The root weakness is improper input validation [CWE-20] across URL parsing, HTML serialization, and Markdown passthrough logic. Each issue permits an attacker-controlled string to escape sanitization and reach the rendered DOM as executable HTML or JavaScript.

The URL helpers clean_url_value and clean_url_in_js_string fail to normalize encoded schemes. Encoded javascript: URLs can pass through, and backslash-prefixed relative URLs are resolved by browsers as remote hosts, enabling open redirects and script loading from attacker-controlled origins.

HTML serialization does not validate programmatic element or attribute names, allowing markup-breaking characters to reshape the output tree. HTML comments can also be constructed to close and reintroduce active markup.

When html_passthrough=True is enabled for Markdown, raw </textarea> tags are preserved, breaking out of textarea contexts and reintroducing arbitrary HTML. Custom policies that extend defaults may retain <style>, <meta http-equiv="refresh">, or <base href> tags, enabling CSS-based data exfiltration, forced navigation, and URL rebasing attacks.

Root Cause

The root cause is inconsistent input validation across helper APIs, programmatic DOM construction paths, and optional passthrough modes. Trusted-output assumptions inside justhtml do not hold when callers use these secondary interfaces or non-default configurations.

Attack Vector

Exploitation is network-accessible and requires no privileges or user interaction. An attacker submits crafted user input to any application surface that stores or renders content through the affected helpers, html_passthrough=True, or a vulnerable custom policy. Most issues do not affect the default sanitize=True configuration.

See the GitHub Security Advisory and the VulnCheck Advisory for JustHTML for per-issue technical details.

Detection Methods for CVE-2026-5388

Indicators of Compromise

Stored content containing encoded javascript: URLs such as javascript: or percent-encoded variants in fields processed by clean_url_value or clean_url_in_js_string.
User-supplied URLs beginning with a backslash (\) that resolve to remote hosts when rendered in a browser.
Rendered pages containing unexpected <style>, <meta http-equiv="refresh">, <base href>, or raw </textarea> tags originating from user input.

Detection Strategies

Perform a software composition analysis (SCA) scan across Python dependencies to identify any justhtml version below 1.15.0.
Grep source repositories for calls to clean_url_value, clean_url_in_js_string, html_passthrough=True, and any custom policy definitions that extend the default allowlist.
Review application logs and stored content for URL and markup patterns that match the bypass vectors described in the advisory.

Monitoring Recommendations

Enable web application firewall (WAF) rules that flag encoded javascript: schemes and backslash-prefixed URLs on user input endpoints.
Monitor Content Security Policy (CSP) violation reports for inline script and unexpected external script origins introduced by rendered content.
Alert on newly introduced <meta http-equiv>, <base>, or <style> tags in output surfaces that should not contain them.

How to Mitigate CVE-2026-5388

Immediate Actions Required

Upgrade justhtml to version 1.15.0 or later across all applications and services.
Audit all uses of clean_url_value, clean_url_in_js_string, html_passthrough=True, and custom sanitization policies for exposure to untrusted input.
Re-render or purge cached output that was produced by vulnerable versions and contains user-supplied HTML or URLs.

Patch Information

The maintainers addressed the issues in justhtml 1.15.0. Refer to the GitHub Security Advisory for the fix commits and per-issue remediation notes.

Workarounds

Use the default sanitize=True configuration and avoid html_passthrough=True where possible until the upgrade is deployed.
Restrict custom policies to remove <style>, <meta http-equiv="refresh">, and <base href> tags from allowlists.
Apply a strict Content Security Policy that blocks inline scripts and limits external script and style sources.

bash

# Upgrade justhtml to a patched version
pip install --upgrade 'justhtml>=1.15.0'

# Verify the installed version
python -c "import justhtml; print(justhtml.__version__)"