justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw </textarea> reintroduction through Markdown passthrough, or preserved <style>/<meta http-equiv=refresh>/<base href> tags in custom policies. Most custom-policy issues do not affect the default sanitize=True configuration; they primarily affect helper APIs, programmatic DOM construction, html_passthrough=True, and custom policies/transform pipelines.

justhtml versions before 1.15.0 contain multiple security vulnerabilities in URL sanitization helpers, HTML serialization, Markdown passthrough, and custom sanitization policies. Attackers can bypass sanitization to inject active HTML and JavaScript through various vectors including encoded javascript: URLs, backslash-based relative URLs, and markup-breaking element/attribute names. The Markdown passthrough feature (html_passthrough=True) allows raw </textarea> reintroduction, and custom policies may preserve dangerous tags like <style>, <meta http-equiv=refresh>, and <base href>. While the default sanitize=True configuration is largely unaffected, helper APIs, programmatic DOM construction, and custom policy pipelines are at risk. The vulnerability has been assigned CVE-2026-5388 and addressed in justhtml 1.15.0. Security advisories have been published on GitHub and VulnCheck.