Security: EmilStenstrom/justhtml
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Default sanitizer bypass: <selectedcontent> projection re-inserts unsanitized subtree (plus two availability findings)GHSA-gjf2-f4jc-69xf published
Aug 6, 2026 by EmilStenstromHigh -
justhtml: to_markdown() code-span blank-line breakout enables XSSGHSA-jf6w-2mvx-633j published
May 22, 2026 by EmilStenstromModerate -
Denial-of-service hardening in justhtml 1.18.0GHSA-r8cj-3554-33mr published
May 4, 2026 by EmilStenstromLow -
Multiple security fixes in justhtml 1.16.0 found by LLMGHSA-vrx2-77f2-ww34 published
Apr 19, 2026 by EmilStenstromModerate -
Multiple security fixes in justhtml 1.15.0 found by LLMGHSA-4p64-v8f5-r2gx published
Apr 12, 2026 by EmilStenstromLow -
Multiple security fixes in justhtml 1.14.0 found by LLMGHSA-c9vm-hv86-f23r published
Apr 9, 2026 by EmilStenstromModerate -
Mutation XSS with custom foreign-namespace sanitization policiesGHSA-r758-8hxw-4845 published
Apr 5, 2026 by EmilStenstromModerate -
to_markdown() XSS via code fence breakout in <pre> contentGHSA-5vp3-3cg6-2rq3 published
Mar 21, 2026 by EmilStenstromHigh -
Sanitizer Bypass (in Markdown)GHSA-3rcm-vjrc-p45j published
Mar 18, 2026 by EmilStenstromHigh -
Mutation XSS via Literal Text Serialization in Raw Text Elements (style/script)GHSA-qvc2-mg72-jjhx published
Mar 18, 2026 by EmilStenstromModerate