Critical Security Issues in justhtml npm Package: Upgrade Now
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- justhtml (npm)
- Affected versions
- >= v1.14.0, <= v1.14.0 or >= v1.13.0, <= v1.13.0 or >= v1.12.0, <= v1.12.0 or >= v1.11.0, <= v1.11.0 or >= v1.10.0, <= v1.10.0 or >= v1.9.1, <= v1.9.1 or >= v1.9.0, <= v1.9.0 or >= v1.8.0, <= v1.8.0 or >= v1.7.0, <= v1.7.0 or >= v1.6.0, <= v1.6.0 or >= v1.5.0, <= v1.5.0 or >= v1.4.0, <= v1.4.0 or >= v1.3.0, <= v1.3.0 or >= v1.2.0, <= v1.2.0 or >= v1.1.0, <= v1.1.0 or >= v1.0.0, <= v1.0.0 or >= v0.40.0, <= v0.40.0 or >= v0.39.0, <= v0.39.0 or >= v0.38.0, <= v0.38.0 or >= v0.37.0, <= v0.37.0 or >= v0.36.0, <= v0.36.0 or >= v0.35.0, <= v0.35.0 or >= v0.34.0, <= v0.34.0 or >= v0.33.0, <= v0.33.0 or >= v0.32.0, <= v0.32.0 or >= v0.31.0, <= v0.31.0 or >= v0.30.0, <= v0.30.0 or >= v0.29.0, <= v0.29.0 or >= v0.28.0, <= v0.28.0 or >= v0.27.0, <= v0.27.0 or >= v0.26.0, <= v0.26.0 or >= v0.25.0, <= v0.25.0 or >= v0.24.0, <= v0.24.0 or >= v0.23.0, <= v0.23.0 or >= v0.22.0, <= v0.22.0 or >= v0.21.0, <= v0.21.0 or >= v0.20.0, <= v0.20.0 or >= v0.19.0, <= v0.19.0 or >= v0.18.0, <= v0.18.0 or >= v0.17.0, <= v0.17.0 or >= v0.16.0, <= v0.16.0 or >= v0.15.0, <= v0.15.0 or >= v0.14.0, <= v0.14.0 or >= v0.13.1, <= v0.13.1 or >= v0.13.0, <= v0.13.0 or >= v0.12.0, <= v0.12.0 or >= v0.11.0, <= v0.11.0 or >= v0.10.0, <= v0.10.0 or >= v0.9.0, <= v0.9.0 or >= v0.8.0, <= v0.8.0 or >= v0.7.0, <= v0.7.0 or >= v0.6.0, <= v0.6.0 or >= v0.5.2, <= v0.5.2 or >= v0.5.1, <= v0.5.1 or >= v0.5.0, <= v0.5.0 or >= v0.4.0, <= v0.4.0 or >= v0.3.0, <= v0.3.0 or >= v0.2.0, <= v0.2.0 or >= v0.1.0, <= v0.1.0
- Patched version
- 1.15.0
The justhtml npm package before version 1.15.0 contains multiple security issues that can allow an attacker to bypass sanitization and inject active HTML and JavaScript.
What happened
The justhtml npm package before version 1.15.0 contains multiple security issues in URL sanitization, HTML serialization, and Markdown passthrough. These issues can allow an attacker to bypass sanitization and inject active HTML and JavaScript. The issues primarily affect advanced usage rather than the default configuration. The vulnerabilities have been assigned CVE-2026-5388, CVE-2026-7808, and CVE-2026-8445 with a CVSS score of 9.8, indicating a critical severity.
To assess your exposure, check if your project uses the justhtml npm package in a version before 1.15.0. If so, you are potentially affected by these security issues.
What to do about it
- Upgrade the justhtml npm package to version 1.15.0 or later to mitigate the security issues.
- Review your project's configuration and usage of the justhtml package to ensure it aligns with the recommended secure practices.
- Monitor the NVD and other primary sources for any updates or additional information related to these vulnerabilities.
How 0Day would have caught this
justhtml is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if your project uses the justhtml npm package in a version before 1.15.0.
What should I do right now?
Upgrade the justhtml npm package to version 1.15.0 or later to mitigate the security issues.
What are the specific vulnerabilities?
The specific vulnerabilities are tracked as CVE-2026-5388, CVE-2026-7808, and CVE-2026-8445.
Has this been exploited in the wild?
No, according to the primary sources, this vulnerability has not been exploited in the wild.