That 'critical' 9.8 bug in justhtml? GitHub itself only calls it 'Moderate'

A newly disclosed flaw in justhtml, a Python library used to sanitise and serialise HTML, has been given a headline-grabbing CVSS score of 9.8 out of 10 - “critical” by NVD’s reckoning. The project’s own maintainer, however, filed it as “Moderate” severity. Both can’t be entirely right, and the gap tells you most of what you need to know about how to read this one.

What the bug actually does

justhtml is a helper library that developers use to strip dangerous markup out of user-supplied HTML and Markdown before it gets rendered in a browser - the sort of thing that stops someone posting a comment full of hidden <script> tags. Versions up to 1.14.0 contain a cluster of related weaknesses, all fixed in 1.15.0, released in April.

According to the GitHub advisory and NVD’s description, the sanitiser’s URL-cleaning helpers could be tricked into passing through encoded javascript: links, and backslash-based paths (\\evil.example/x) that browsers happily resolve as remote addresses even though the sanitiser treated them as harmless local ones. Other variants involve markup-breaking element and attribute names, HTML comments used to smuggle content past filters, a raw </textarea> tag reappearing via Markdown passthrough, and certain “safe” custom policies that still let through <style>, <meta http-equiv=refresh> or <base href> tags - each of which can be abused to redirect users or inject styling-based attacks.

So who is actually at risk

Here’s the catch NVD’s score doesn’t convey well: the advisory states plainly that “most custom-policy issues do not affect the default sanitize=True configuration.” In other words, if you’re using justhtml out of the box in its standard, recommended mode, you’re largely shielded. The riskier paths are for developers who’ve reached for the lower-level helper functions directly, built HTML programmatically without going through the default sanitiser, turned on html_passthrough=True for Markdown, or written their own custom sanitisation policy. That’s a meaningfully smaller pool of affected setups than “every user of this library,” which is presumably why GitHub itself rated the issue Moderate while VulnCheck’s independently calculated CVSS 3.1 score of 9.8 (and CVSS 4.0 score of 9.3) landed at Critical.

There’s no suggestion in any of the sources that this is being actively exploited - it’s a set of issues found, per the GitHub advisory’s title, “by LLM”, i.e. surfaced through automated/AI-assisted code review rather than an in-the-wild attack. The library itself has a modest but real footprint - around 1,200 GitHub stars - so this is not an internet-scale event, but it will matter to sites and services quietly relying on it to keep user content safe.

What to do about it

If your project (or a dependency of it) uses justhtml, the fix is simple: upgrade to 1.15.0 or later. If you’re only using the default sanitize=True mode and nothing fancier, your exposure was already limited. If you’re using the helper functions directly, custom policies, programmatic DOM construction, or Markdown passthrough, treat the update as more urgent, since those are exactly the configurations the fixes target.

The takeaway

This is a genuine set of sanitisation bugs worth patching, not a hoax - but the “critical, 9.8” framing overstates the danger for the ordinary default user. As ever with CVSS scores, they measure theoretical worst-case severity, not how many real deployments are actually exposed. Update the library, check your configuration, and move on.