CyberRota Analysis
AI-GeneratedJustHTML versions prior to 1.16.0 are vulnerable to multiple HTML sanitization bypass issues that can permit the execution of active content, such as scripts or styles, leading to potential cross-site scripting (XSS) attacks. This vulnerability primarily affects advanced users who manipulate sanitization policies or utilize programmatic DOM inputs, making it critical for developers and organizations using JustHTML in their applications to prioritize upgrading to the patched version. Immediate action is recommended to mitigate the risk of exploitation in web applications relying on this library.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML(..., sanitize=True) path for ordinary parsed HTML: mutating or reusing sanitization policy objects (including exported defaults) could weaken later sanitization; programmatic DOM input to sanitize()/sanitize_dom() could miss mixed-case tag names (e.g., ScRiPt, StYlE); crafted programmatic doctype names could serialize into active markup; and custom policies preserving SVG or MathML could allow animation elements, presentation attributes with external url(...) references, or DOM trees mislabeled as namespace="html" to bypass foreign-content checks. Fixed in 1.16.0.