GHSA-vrx2-77f2-ww34 — justhtml
GHSA-vrx2-77f2-ww34 is a security vulnerability in justhtml. A fix is available for justhtml — see the affected versions and patch details below.
justhtml has sanitization bypass in custom policies and programmatic DOM
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-vrx2-77f2-ww34.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Real-World Exposure
justhtmlReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
justhtml 1.17.0 fixes multiple security issues in sanitization, serialization, and programmatic DOM handling.
Most of these issues affected advanced or custom configurations rather than the default safe path.
Affected versions
justhtml<= 1.16.0
Fixed version
justhtml1.17.0released on April 19, 2026
Impact
Custom SVG / MathML sanitization policies
Custom policies that preserved foreign namespaces could allow dangerous content to survive sanitization, including:
- active HTML integration points such as SVG
<foreignObject>, MathML<annotation-xml encoding="text/html">, SVG<title>/<desc>, and MathML text integration points - mutation-XSS parser-differential payloads that looked inert in memory but became active HTML after reparse
- SVG
filter="url(...)"attributes that could trigger external fetches
These issues affected:
JustHTML(..., sanitize=True)with custom foreign-namespace policiessanitize()/sanitize_dom()- low-level terminal
Sanitize(...)transform execution
Preserved <style> handling
Constructor-time sanitization and explicit Sanitize(...) transforms did not fully match sanitize() / sanitize_dom() when custom policies preserved <style>.
That could leave resource-loading CSS such as @import or background-image:url(...) in sanitized output from HTML string input.
Programmatic DOM serialization
Programmatic script, style, and Comment(...) nodes could still serialize into active markup in some edge cases.
This could affect applications that build or mutate DOM trees directly before calling to_html() or to_markdown(html_passthrough=True).
Cache mutation and DOM cycle handling
Two lower-severity hardening fixes were included:
- compiled sanitize-pipeline caches could be mutated after warming and weaken later sanitization
- parent/child cycles in programmatic DOM trees could cause infinite loops in operations such as
to_html()andsanitize_dom()
Default configuration
Most of the issues above did not affect ordinary parsed HTML with the default JustHTML(..., sanitize=True) configuration.
The main risk areas were:
- custom policies that preserve SVG or MathML
- custom policies that preserve
<style> - programmatic DOM construction or mutation
- low-level direct sanitizer/transform APIs
Recommended action
Upgrade to justhtml 1.17.0.
If users cannot upgrade immediately:
- avoid preserving SVG or MathML for untrusted input
- avoid preserving
<style>for untrusted input - avoid mutating programmatic DOM trees with untrusted
script,style, or comment content - avoid mutating warmed policy internals or sanitizer caches
Credit
Discovered during an internal security review of justhtml.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | justhtml | all versions | 1.17.0pip install --upgrade 'justhtml==1.17.0' |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for justhtml, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update justhtml to 1.17.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-vrx2-77f2-ww34 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-vrx2-77f2-ww34 can be triaged on real exposure rather than presence alone.
Tailored to GHSA-vrx2-77f2-ww34. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-vrx2-77f2-ww34 in your dependencies?
O3 Security finds GHSA-vrx2-77f2-ww34 across PyPI dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.