{"answers":{"affected":"3 open source packages ship an affected version, including justhtml.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-9769 exists.","fix":"Upgrade justhtml to 1.10.0 or later.","what":"CVE-2026-9769 is a high-severity denial of service vulnerability in EmilStenstrom justhtml, published on 23 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-9769 and fix it if it is affected.\n\nWhat it is: CVE-2026-9769 is a high-severity denial of service vulnerability in EmilStenstrom justhtml, published on 23 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-9769 exists.\n\nAffected packages and fixed versions:\n- justhtml (PyPI): affected all versions; fixed in 1.10.0\n- justhtml (PyPI): affected all versions; fixed in 1.10.0\n- justhtml (PyPI): affected all versions; fixed in 1.10.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-9769/ (Markdown: https://insights.sbomify.com/CVE-2026-9769/index.md)","id":"CVE-2026-9769","markdown":"https://insights.sbomify.com/CVE-2026-9769/index.md","name":"CVE-2026-9769","record":{"aliases":["GHSA-v7cf-c9rm-wm3j","PYSEC-2026-3854"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Python HTML parser","requires_auth":"none","summary":"An attacker can cause a denial of service in the justhtml library by supplying deeply nested HTML that triggers an unhandled recursion error.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"VulnCheck","cpe":[],"cvss":{"score":8.7,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-674","name":"Uncontrolled Recursion"}],"description":"justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested \u003cdiv\u003e tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"justhtml before 1.10.0 Denial of Service via deeply nested HTML","id":"CVE-2026-9769","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":3,"n_references":2,"next":{"headline":"Hardcoded Cryptographic Key Information Disclosure Vulnerability on TP-Link Kasa EC70 and EC71","id":"CVE-2026-9770"},"packages":[{"ecosystem":"PyPI","fixed":["1.10.0"],"introduced":["0"],"last_affected":[],"package":"justhtml","purl":null,"source":"GHSA-v7cf-c9rm-wm3j"},{"ecosystem":"PyPI","fixed":["1.10.0"],"introduced":["0"],"last_affected":[],"package":"justhtml","purl":"pkg:pypi/justhtml","source":"GHSA-v7cf-c9rm-wm3j"},{"ecosystem":"PyPI","fixed":["1.10.0"],"introduced":["0"],"last_affected":[],"package":"justhtml","purl":"pkg:pypi/justhtml","source":"PYSEC-2026-3854"}],"prev":{"headline":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","id":"CVE-2026-9768"},"products":["justhtml"],"published":"2026-08-23","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-24","vendors":["EmilStenstrom"]},"summary":"An attacker can cause a denial of service in the justhtml library by supplying deeply nested HTML that triggers an unhandled recursion error.","url":"https://insights.sbomify.com/CVE-2026-9769/"}