CyberRota Analysis
AI-GeneratedThe vulnerability affects JustHTML versions up to 1.9.1, allowing attackers to exploit uncontrolled recursion during HTML parsing, which can lead to a denial of service. By supplying deeply nested HTML elements, an attacker can exceed the default recursion limit in CPython, potentially causing the application to abort parsing or terminate processes. Organizations using JustHTML for HTML parsing should prioritize upgrading to version 1.10.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested <div> tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.