A critical sanitization bypass vulnerability in the EmilStenstrom justhtml library allows attackers to inject malicious scripts into applications, leading to potential cross-site scripting.

This vulnerability involves improper input validation (CWE-20) where the sanitizer fails to properly neutralize dangerous content like mixed-case tags or crafted doctype names. The vulnerability is exploitable by an unauthenticated attacker providing malicious input to an application using the library.

The CVSS score of 9.8 highlights the severe risk posed to applications relying on this library for content sanitization. Successful exploitation allows for the execution of arbitrary scripts in the context of a user session, potentially leading to session hijacking, data theft, or malicious redirection.

Immediate Action: Update the PyPI package justhtml to version 1.16.0 or higher.

Proactive Monitoring: Inspect web application logs for suspicious patterns in user-submitted content, particularly those attempting to inject script or style tags.

Compensating Controls: Implement a robust Content Security Policy (CSP) to restrict the execution of unauthorized scripts, which can serve as a secondary defense against cross-site scripting attacks.

Public Exploit Available: Unknown.

Organizations utilizing the justhtml library must update to version 1.16.0 immediately to remediate these sanitization bypasses. Developers should verify that their implementation does not rely on deprecated or mutated sanitization policies that could reintroduce these risks.