Vulnerability	Vulnerable Version
M Modification of Assumed-Immutable Data (MAID) justhtml is an A pure Python HTML5 parser that just works. Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data (MAID) through the `sanitize()`, `sanitize_dom()`, and `JustHTML(..., sanitize=True)` paths in `src/justhtml/sanitize.py`. An attacker can bypass intended HTML filtering by mutating nested policy state, such as `allowed_attributes` or `url_policy.allow_rules` after a sanitizer has been compiled, causing later sanitization calls to keep using a previously compiled, more permissive policy and preserve dangerous markup or URLs. The same issue affects exported default policy objects process-wide, so weakening `DEFAULT_POLICY.url_policy.allow_rules[("a", "href")].allowed_schemes` can alter subsequent default sanitization and let malicious links survive in user-visible output. Note: The maintainer aggregated multiple security fixes into one advisory; a detailed explanation of the individual impacts is detailed in the maintainer's advisory. How to fix Modification of Assumed-Immutable Data (MAID)? Upgrade `justhtml` to version 1.16.0 or higher.	[,1.16.0)

Modification of Assumed-Immutable Data (MAID)

justhtml is an A pure Python HTML5 parser that just works.

Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data (MAID) through the sanitize(), sanitize_dom(), and JustHTML(..., sanitize=True) paths in src/justhtml/sanitize.py. An attacker can bypass intended HTML filtering by mutating nested policy state, such as allowed_attributes or url_policy.allow_rules after a sanitizer has been compiled, causing later sanitization calls to keep using a previously compiled, more permissive policy and preserve dangerous markup or URLs. The same issue affects exported default policy objects process-wide, so weakening DEFAULT_POLICY.url_policy.allow_rules[("a", "href")].allowed_schemes can alter subsequent default sanitization and let malicious links survive in user-visible output.

Note: The maintainer aggregated multiple security fixes into one advisory; a detailed explanation of the individual impacts is detailed in the maintainer's advisory.

How to fix Modification of Assumed-Immutable Data (MAID)?

Upgrade justhtml to version 1.16.0 or higher.

[,1.16.0)

Go back to all versions of this package