Vulnerabilities for justhtml

First version without a known vulnerability: 1.22.0

Details

• GHSA-jf6w-2mvx-633j2026-06-25

  justhtml: to_markdown() code-span blank-line breakout enables XSS

  Fixed in: 1.22.0

• GHSA-r8cj-3554-33mr2026-05-08

  justhtml introduces denial-of-service hardening

  Fixed in: 1.18.0

• GHSA-vrx2-77f2-ww342026-04-22

  justhtml has sanitization bypass in custom policies and programmatic DOM

  Fixed in: 1.17.0

• GHSA-4p64-v8f5-r2gx2026-04-14

  Multiple security fixes in justhtml

  Fixed in: 1.16.0

• GHSA-c9vm-hv86-f23r2026-04-10

  justhtml includes multiple security fixes

  Fixed in: 1.15.0

• GHSA-r758-8hxw-48452026-04-08

  justhtml: Mutation XSS with custom foreign-namespace sanitization policies

  Fixed in: 1.14.0

• GHSA-5vp3-3cg6-2rq32026-03-24

  JustHTML is vulnerable to XSS via code fence breakout in <pre> content

  Fixed in: 1.13.0

• GHSA-3rcm-vjrc-p45j2026-03-18

  JustHTML has a Sanitizer Bypass (in Markdown)

  Fixed in: 1.12.0

• GHSA-qvc2-mg72-jjhx2026-03-18

  JustHTML Affected by Mutation XSS via Literal Text Serialization in Raw Text Elements (style/script)

  Fixed in: 1.12.0

• GHSA-v7cf-c9rm-wm3j2026-03-17

  Uncontrolled recursion DoS in JustHTML() via deeply nested HTML

  Fixed in: 1.10.0