CVE-2026-4671
Received Received - Intake

JustHTML Denial-of-Service in CSS Selector Handling

Publication date: 2026-08-23

Last updated on: 2026-08-23

Assigner: VulnCheck

Description
justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings (via query(), matches(), or selector-based transforms), run selector matching over very large untrusted documents, construct DOM trees from untrusted structure, or enable linkification over attacker-controlled text may consume disproportionate CPU or memory. Triggers include oversized selectors, large selector lists, oversized compound selectors, long combinator chains, deeply nested functional pseudo-classes, repeated token/positional matching, cyclic DOM graphs causing non-terminating traversal, and punctuation-heavy or trailing-bracket linkification input. These are availability-only concerns and do not by themselves allow script execution, data disclosure, or sanitizer bypass. Default JustHTML(sanitize=True) usage is not expected to be exposed, since selectors are normally supplied by application code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-23
Last Modified
2026-08-23
Generated
2026-08-23
AI Q&A
2026-08-23
EPSS Evaluated
N/A
NVD
CVE-2026-4671
EUVD
EUVD-2026-64651

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
justhtml justhtml to 1.18.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-4671 is a denial-of-service vulnerability in justhtml versions before 1.18.0. It involves uncontrolled resource consumption during CSS selector handling and linkification. Attackers can trigger excessive CPU or memory usage by providing oversized selectors, large selector lists, deeply nested pseudo-classes, or cyclic DOM graphs. The issue does not allow script execution or data disclosure but disrupts application availability.

Detection Guidance

Detecting this vulnerability requires checking the version of justhtml in use. Run 'npm list justhtml' or 'pip show justhtml' to verify if the installed version is below 1.18.0. Monitor system resource usage during CSS selector processing or linkification tasks for unusual CPU or memory spikes.

Impact Analysis

This vulnerability can cause application slowdowns or crashes by consuming excessive CPU or memory. Systems processing untrusted inputs like attacker-controlled text or large documents are most affected. Default usage with sanitization enabled is not impacted since selectors are controlled by application code.

Compliance Impact

This vulnerability primarily impacts availability by causing excessive CPU or memory consumption through crafted CSS selectors or linkification inputs. It does not directly lead to data disclosure or script execution, which are key concerns for GDPR and HIPAA compliance. However, prolonged denial-of-service conditions could disrupt services handling sensitive data, potentially violating availability requirements in these regulations.

Mitigation Strategies

Upgrade justhtml to version 1.18.0 or later immediately. If upgrading is not possible, disable linkification on untrusted text, avoid processing large untrusted documents, and restrict selector inputs to trusted sources. Implement resource limits and cycle guards in DOM processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4671. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart