CVE-2026-5388 — justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers…

Key facts

CVE-2026-5388 is a Critical (9.8) vulnerability: justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers…. This entry ships a detection-only PoC and a Docker test lab.

CVE	CVE-2026-5388
Severity	Critical (9.8)
Detection / prevention	—
PoC	poc.py
Source	2026/CVE-2026-5388/

Details

English | 한국어

Description

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw reintroduction through Markdown passthrough, or preserved