CVE-2026-5388

CVE-2026-5388 identifies multiple security vulnerabilities within the `justhtml` library, specifically in versions prior to 1.15.0. These issues are primarily found in URL sanitization helpers, HTML serialization, and Markdown passthrough functionalities when `html_passthrough=True` is enabled, as well as in several edge cases related to custom sanitization policies. An attacker can exploit these flaws to bypass existing sanitization mechanisms and inject active HTML and JavaScript code. This can be achieved through various methods, including encoded `javascript:` URLs, backslash-based relative URLs that are resolved as remote hosts, programmatic element/attribute names or HTML comments that break markup, reintroduction of raw `</textarea>` tags via Markdown passthrough, or by preserving `<style>`, `<meta http-equiv=refresh>`, or `<base href>` tags within custom policies. It is important to note that most of these custom-policy related issues do not impact the default `sanitize=True` configuration, but rather affect helper APIs, programmatic DOM construction, and custom policies/transform pipelines.