justhtml before version 1.15.0 contains multiple sanitization failures that allow an attacker to inject active HTML and JavaScript into the output. The vulnerabilities affect URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough, and several edge cases in custom sanitization policies. An attacker can exploit these weaknesses—for example by supplying encoded javascript: URLs, backslash‑based relative URLs that resolve to remote hosts, or by using markup‑breaking element or attribute names, HTML comments, or raw </textarea> tags in Markdown passthrough. The consequence is the ability to execute arbitrary client‑side code, effectively enabling cross‑site scripting in the user’s browser context. The flaw is classified as an input validation weakness (CWE‑20).

Any installation of justhtml by EmilStenstrom that uses a version earlier than 1.15.0 is affected. The vulnerability impacts every configuration that relies on the default sanitize=True setting, helper APIs, programmatic DOM construction, html_passthrough=True, or custom sanitization policies/transform pipelines. Users of justhtml should verify their installed version and upgrade if it is below 1.15.0.

The CVSS score of 9.3 indicates a high severity and the system is considered vulnerable to exploitation via manipulation of input supplied to justhtml’s sanitization functions or through crafted URLs and markdown content. Although the EPSS score is not available, the lack of inclusion in the CISA KEV catalog does not diminish the risk, particularly because these issues allow injection of client‑side scripts that can persist across standard web application boundaries. The most likely attack vector is through user‑controlled input—for example, request parameters, form fields, or content rendering streams that are processed by justhtml. Attackers with access to input that goes through clean_url_value or the markdown passthrough feature can bypass the default protection, leading to injection of malicious code.