CVE-2026-5388: Improper Input Validation in EmilStenstrom justhtml

CVE-2026-5388 describes multiple security flaws in justhtml before version 1.15.0 involving improper input validation in URL sanitization helpers (clean_url_value and clean_url_in_js_string), HTML serialization, Markdown passthrough with html_passthrough=True, and several edge cases in custom sanitization policies. These flaws enable attackers to bypass sanitization controls and inject active HTML and JavaScript code. Examples include injection via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking element or attribute names, HTML comments, raw </textarea> tags reintroduced through Markdown passthrough, and preservation of <style>, <meta http-equiv=refresh>, and <base href> tags in custom policies. The default sanitize=true configuration is largely unaffected, with most issues arising in custom or programmatic use cases.

The vulnerability allows attackers to bypass sanitization and inject active HTML and JavaScript, which can lead to cross-site scripting (XSS) attacks. This can result in unauthorized script execution in the context of users of applications relying on affected justhtml versions, potentially compromising user data, session integrity, or enabling other malicious actions. The impact is critical given the high CVSS score (9.3) and the ability to execute code without user interaction or privileges.

No official patch or remediation level is currently confirmed. Users should upgrade to justhtml version 1.15.0 or later once available, as the vulnerability affects versions before 1.15.0. Until a fix is confirmed, avoid using custom sanitization policies, html_passthrough=True, and programmatic DOM construction features that rely on vulnerable sanitization helpers. Use the default sanitize=true configuration where possible to reduce exposure. Monitor the vendor advisory for updates on official fixes.