justhtml includes multiple security fixes
Date: 2026-04
Affected: pip/justhtml
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-178
CWE-20
CWE-755
CWE-79

## Summary `justhtml` `1.15.0` includes multiple security fixes affecting URL sanitization helpers, HTML serialization, Markdown passthrough, and several custom sanitization-policy edge cases. These issues have different impact levels and do not all affect the default configuration in the same way. ## Affected versions - `justhtml` `<= 1.14.0` ## Fixed version - `justhtml` `1.15.0` released on April 9, 2026 ## Impact overview ### Helper and serialization issues These issues could affect applications using JustHTML helpers or programmatic DOM construction, even outside the default HTML sanitization path. - `JustHTML.clean_url_value(...)` and `clean_url_in_js_string(...)` could accept URL values such as `javascript&#58...`, which became active `javascript:` URLs after HTML attribute parsing. - URL sanitization could treat values like `\\evil.example/x` or `/\\evil.example/x` as safe relative URLs even though browsers could resolve them as remote requests. - Malformed bracketed hosts such as `https://[evil.example]/x` could raise exceptions and crash sanitization when host allowlists were used. - Programmatic element or attribute names containing markup-breaking characters could be serialized into active HTML. - Programmatic HTML comments containing `-->` could break out of the comment and inject live markup. ### Markdown passthrough issue - `to_markdown(html_passthrough=True)` could reintroduce active HTML from sanitized `<textarea>` content by emitting a raw closing


Mitigations:

Architectural layers (MAESTRO):