The justhtml library is affected by multiple critical input validation flaws that allow attackers to bypass sanitization and execute arbitrary JavaScript code.

This vulnerability involves improper input validation (CWE-20) across several helper APIs and sanitization policies. The flaw allows unauthenticated attackers to inject malicious HTML and JavaScript via various vectors, including encoded URLs and malformed markup.

Exploitation of this vulnerability enables Cross-Site Scripting (XSS) attacks, which can lead to session hijacking, unauthorized actions on behalf of users, and the theft of sensitive information. With a CVSS score of 9.8, this flaw represents a severe risk to web application security and user trust.

Immediate Action: Update the justhtml package to version 1.15.0 or later as provided in the PyPI repository.

Proactive Monitoring: Review application logs for suspicious input patterns that might indicate attempts to bypass sanitization filters or inject malicious scripts.

Compensating Controls: Ensure that Content Security Policy (CSP) headers are strictly configured to mitigate the impact of potential XSS attacks if immediate patching is delayed.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates an immediate update to the patched version. Developers should verify that their implementation uses the default sanitization settings and avoid relying on custom sanitization policies that may remain vulnerable.