These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-9769 is a denial-of-service vulnerability in justhtml, a Python package for parsing HTML. The vulnerability arises from uncontrolled recursion during the parsing of deeply nested HTML elements, which can lead to a RecursionError and potentially terminate a worker/process. This issue affects justhtml versions up to 1.9.1 and is fixed in version 1.10.0.
CVE-2026-8445 is a critical vulnerability in the justhtml library, which fails to sufficiently escape HTML-significant characters in text nodes when converting a parsed document to Markdown. This allows untrusted input to be emitted as raw HTML in the Markdown output, potentially enabling a sanitizer bypass and cross-site scripting when rendered. The vulnerability affects justhtml versions <= 1.11.0 and i [truncated]
CVE-2026-7808 is a critical vulnerability in the justhtml library before version 1.16.0, which contains multiple HTML sanitization bypass issues. These issues can allow active or dangerous content, such as script or style elements, to survive sanitization, potentially leading to cross-site scripting (XSS) attacks. The vulnerability primarily affects advanced usage of the library, particularly when mutatin [truncated]
CVE-2026-74793 is a cross-site scripting vulnerability in justhtml before version 3.11.0. The vulnerability allows attackers to inject SVG or MathML elements with event handlers that can be cloned and reinserted into output without sanitization, enabling stored or reflected XSS attacks. This vulnerability has a CVSS score of 5.1 and a severity of MEDIUM. Defenders should assess their exposure and prioriti [truncated]
CVE-2026-6827 affects justhtml before 1.17.0, with multiple security issues in sanitization, serialization, and programmatic DOM handling. Custom policies preserving foreign namespaces could allow dangerous content to survive sanitization. Additional hardening fixes address sanitize-pipeline cache mutation and DOM parent/child cycles. Affected product deployments should be reviewed for potential vulnerabi [truncated]
CVE-2026-5751 is a medium-severity vulnerability in justhtml versions 1.13.0 and earlier. The vulnerability is a parser-differential / mutation cross-site scripting (mXSS) issue that occurs when using a custom SanitizationPolicy that preserves foreign namespaces. This could allow for markup injection if specially crafted input is sanitized into markup that appears safe but becomes unsafe when re-parsed by [truncated]
CVE-2026-5389 is a cross-site scripting vulnerability in the justhtml library versions before 1.13.0. The vulnerability exists in the to_markdown() function when serializing attacker-controlled pre content. Attackers can exploit this vulnerability by placing backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the generated Markdown is rendere [truncated]
The CVE-2026-5388 vulnerability in justhtml before version 1.15.0 involves multiple security issues in URL sanitization helpers, HTML serialization, Markdown passthrough, and custom sanitization-policy edge cases. An attacker can bypass sanitization to inject active HTML and JavaScript, potentially leading to security risks. The vulnerability has a CVSS score of 9.3 and is considered critical.
The CVE-2026-4671 vulnerability in justhtml before version 1.18.0 involves multiple low-severity denial-of-service (DoS) issues related to CSS selector handling and linkification. These issues can cause applications to consume disproportionate CPU or memory when evaluating attacker-controlled selector strings or processing large untrusted documents. Triggers for these issues include oversized selectors, l [truncated]