{"action":"Upgrade justhtml to 1.17.0 or later.","affected":[{"fixed":"1.17.0","introduced":"0"}],"component":"justhtml","cve_ids":["CVE-2026-6827"],"ecosystem":"PyPI","epss":0.00261,"exploited":false,"fixed_versions":["1.17.0"],"ghsa_id":"GHSA-vrx2-77f2-ww34","id":"tcs_01M5KG0TP5KTEW6W5N4HMTHJT2","modified_at":"2026-08-24T03:56:00.073719465Z","published_at":"2026-04-22T21:25:46Z","references":["https://osv.dev/vulnerability/GHSA-vrx2-77f2-ww34","https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-vrx2-77f2-ww34","https://github.com/EmilStenstrom/justhtml"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-vrx2-77f2-ww34","url":"https://osv.dev/vulnerability/GHSA-vrx2-77f2-ww34"}],"summary":"justhtml has sanitization bypass in custom policies and programmatic DOM"}