The attack surface is primarily driven by misconfigurations or the use of helper APIs and custom policy pipelines. Attackers can leverage these flaws through techniques such as encoded javascript: pseudo-protocols, malformed relative URLs resolved as remote hosts, and the injection of prohibited elements like <style>, <meta http-equiv=refresh>, and <base href> tags. While default configurations are safer, users relying on custom sanitization policies, programmatic DOM construction, or the html_passthrough=True parameter are at the highest risk. These flaws effectively undermine the security boundary of the library, potentially leading to Stored or Reflected Cross-Site Scripting (XSS) depending on the integration within downstream applications.

Impact

Successful exploitation of these vulnerabilities allows for the execution of arbitrary JavaScript within the context of a victim's browser session. Depending on the target application's sensitivity, this can lead to session hijacking, unauthorized actions performed on behalf of the user, or the exfiltration of sensitive data. Because this is a library-level flaw, the impact is highly dependent on how the library is utilized within specific web applications and CMS frameworks. Organizations utilizing justhtml for content sanitization or Markdown processing should assess whether their specific implementation utilizes the affected helper APIs or custom policies.

Recommendation

• Upgrade the justhtml library to version 1.15.0 or later to patch these sanitization flaws.
• Audit applications using the justhtml library, specifically searching for the use of html_passthrough=True or custom sanitization-policy configurations.
• Implement secondary Content Security Policy (CSP) headers to mitigate the impact of potential XSS vulnerabilities in the event of a bypass.
• Review existing integration code to ensure that clean_url_value and clean_url_in_js_string are not being misused in contexts where user input can influence the URL scheme or hostname.