External risk intelligence

justhtml Security Issues Allow HTML and JavaScript Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-5388

The vulnerability exists in a software library used for HTML sanitization and processing. While such libraries are often integrated into public-facing web applications to handle user input, the specific exposure depends entirely on how developers implement the library and whether they enable features like Markdown passthrough or custom policies that bypass default protections.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security advisory has been issued for `justhtml` versions prior to 1.15.0, detailing vulnerabilities in how the software handles URLs, HTML serialization, and Markdown processing. Depending on its configuration, `justhtml` could be manipulated by an attacker to inject malicious active content, such as JavaScript, into web pages.

Injected code could impact web applications.
Understand potential for active content injection.
Confirm relevance and exposure in your environment.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted input to a web application that uses a vulnerable version of the justhtml library. This input could be designed to bypass the library's URL sanitization or HTML processing, allowing active HTML and JavaScript to be injected into the application. When this injected content is rendered by the application, it can lead to code execution or other malicious actions within the user's browser.

Unauthenticated network access required.
Inject active content via crafted input.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to inject active HTML and JavaScript into applications that use specific configurations of the affected library, potentially leading to the execution of malicious code. The exact impact depends heavily on how the library is implemented and which features are enabled.

Application output could be altered.
Code injection may occur through manipulated URLs.
User sessions or data integrity could be compromised.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in `justhtml` affects applications that process user-provided HTML or Markdown, especially those with custom sanitization policies or enabled Markdown passthrough. The first practical step is to identify all instances of `justhtml`, determine their exposure to untrusted input, and assess their criticality. Subsequently, responsible teams should coordinate remediation, potentially involving vendor engagement or temporary mitigations if immediate patching is not feasible.

Application owners should investigate `justhtml` usage.
Verify reachability and business criticality first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the justhtml software library?

justhtml is a coding library used by developers to safely process, clean, and format HTML and Markdown text within web applications. It acts as a gatekeeper, ensuring that user-provided input does not contain harmful code before it is displayed to others. It is commonly integrated into tools that need to render content safely, such as content management systems, comment sections, or messaging platforms.

What does CVE-2026-5388 mean for security?

This CVE represents a collection of flaws classified as Improper Input Validation (CWE-20). It means the library fails to properly identify and strip out malicious characters or scripts from inputs. Instead of neutralizing potentially dangerous code—like hidden JavaScript or unauthorized HTML tags—the library inadvertently lets it pass through, allowing attackers to manipulate the rendered content in a user's browser.

How can an attacker trigger this vulnerability?

An attacker triggers the bug by sending specially crafted input to an application using a vulnerable version of the library. It is important to note that the default settings are often safer; the vulnerability is most likely to be triggered when using specific helper functions, enabling Markdown passthrough, or applying complex custom sanitization policies that deviate from the library's standard, safer configuration.

Is my application at risk?

Halo Surface Signal indicates that risk depends on your implementation. If your application processes untrusted user input and uses custom `justhtml` configurations or enabled features like Markdown passthrough, it is more likely to be affected. Applications that rely solely on the default, strict sanitization settings are significantly less prone to these specific injection issues.

What should I do if I use justhtml?

Start by identifying every instance where your systems use the justhtml library. Determine which of these applications accept input from external users and assess how they are configured, specifically looking for custom policies or enabled passthrough features. Once you have mapped these, prioritize updating to version 1.15.0 or later to ensure the sanitization mechanisms are correctly fixed.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.