CVE-2026-5388
Received Received - Intake

HTML and JavaScript Injection in JustHTML

Publication date: 2026-08-23

Last updated on: 2026-08-23

Assigner: VulnCheck

Description
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-23
Last Modified
2026-08-23
Generated
2026-08-23
AI Q&A
2026-08-23
EPSS Evaluated
N/A
NVD
CVE-2026-5388
EUVD
EUVD-2026-64652

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
emilstenstrom justhtml to 1.15.0 (exc)
emilstenstrom justhtml 1.15.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-5388 is a vulnerability in the justhtml library affecting versions before 1.15.0. It involves multiple security issues in URL sanitization, HTML serialization, and Markdown passthrough. Attackers can bypass sanitization to inject malicious JavaScript or HTML through crafted inputs like encoded URLs, relative URLs, or specific HTML tags.

Detection Guidance

Detecting this vulnerability requires checking the version of the justhtml library in use. Commands like 'npm list justhtml' or 'pip show justhtml' can help identify the installed version. If the version is 1.14.0 or earlier, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers to inject active HTML or JavaScript into web pages, potentially leading to cross-site scripting (XSS) attacks. This could result in unauthorized data access, session hijacking, or defacement of websites using the affected library.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR and HIPAA compliance requirements. Organizations using the affected library may face legal penalties, reputational damage, and loss of trust due to compromised data integrity and confidentiality.

Mitigation Strategies

Immediately upgrade to justhtml version 1.15.0 or later. If upgrading is not possible, avoid unsafe configurations, validate all inputs rigorously, and disable Markdown passthrough (html_passthrough=True) if enabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-5388. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart