Multiple Security Issues in JustHTML Prior to Version 1.15.0

CVE-2026-5388

What is CVE-2026-5388?

JustHTML versions before 1.15.0 are susceptible to various security vulnerabilities related to URL sanitization helpers and HTML serialization. Attackers may exploit these vulnerabilities to bypass security measures and inject active HTML or JavaScript into affected applications. The issues arise from weak sanitization mechanisms, particularly in configurations that allow for Markdown passthrough and custom sanitization policies. For instance, attackers might use encoded JavaScript URLs or manipulate DOM constructions to introduce malicious code. Custom policies can exacerbate these vulnerabilities, allowing for injection through backslash-based relative URLs and reintroduced HTML elements that should have been sanitized. Users are strongly encouraged to upgrade to version 1.15.0 or later for improved security.

References