CVE-2026-5388 : 상세 정보

CVE-2026-5388

9.8
/
긴급
2026-08-23
14h16 +00:00
A03-Injection
Network
2026-10-12
16h10 +00:00
CVE.org
NVD
특정 CVE 알림
특정 CVE의 변경 사항에 대한 정보를 받아보세요.
알림 관리

CVE 설명

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-based relative URLs resolved as remote hosts, markup-breaking programmatic element/attribute names or HTML comments, raw reintroduction through Markdown passthrough, or preserved